CVE-2026-2030 describes a stored cross-site scripting vulnerability in the WPBakery Page Builder Addons by Livemesh WordPress plugin. The issue stems from shortcode attributes being encoded with wp_json_encode() but output into single-quoted data-settings HTML attributes without proper escaping via esc_attr(). This allows attackers with Contributor-level privileges or above to inject single quotes and break out of the attribute context, enabling arbitrary script injection that executes when the page is accessed. The vulnerability affects all plugin versions up to 3.9.4. No patch or official fix has been documented as of the published date.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject arbitrary JavaScript into pages using the vulnerable shortcodes. This can lead to script execution in the context of users viewing the page, potentially resulting in session hijacking, privilege escalation, or other malicious actions depending on the injected payload. The CVSS score of 6.4 (medium severity) reflects the network attack vector, low attack complexity, and the requirement for some privileges. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcodes if possible. Monitor vendor channels for updates and apply any official patches promptly once available.