CVE-2026-3895 is a stored cross-site scripting vulnerability in the WPBakery Page Builder Addons by Livemesh WordPress plugin. The vulnerability arises from the `lvca_admin_ajax` AJAX action handler, which verifies a nonce but fails to check user capabilities, allowing authenticated users with low privileges (Subscriber and above) to modify plugin settings and inject malicious scripts. These scripts execute in the context of administrators accessing the plugin settings page or any user visiting the frontend, potentially leading to privilege escalation or session hijacking. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Subscriber-level access or higher can exploit this vulnerability to inject persistent malicious scripts into the plugin settings. These scripts execute when administrators access the plugin settings page or when any user visits the frontend, potentially compromising administrator accounts or site visitors. The impact includes limited confidentiality and integrity loss but no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and consider disabling or limiting access to the vulnerable AJAX functionality if possible. Monitor for plugin updates from Livemesh addressing this issue.