CVE-2026-3896 is a stored XSS vulnerability in the Livemesh SiteOrigin Widgets WordPress plugin caused by missing authorization checks in the `lsow_admin_ajax` AJAX handler. Although the handler verifies a nonce, it fails to verify user capabilities, allowing authenticated users with low privileges (Subscriber and above) to modify plugin settings and inject malicious scripts. These scripts execute in the context of administrators accessing the plugin settings page or any user visiting the frontend, potentially leading to privilege escalation or session hijacking. The vulnerability is tracked under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with authenticated Subscriber-level access or higher can exploit this vulnerability to inject persistent malicious scripts into the plugin settings. These scripts execute when administrators access the plugin settings page or when any user visits the frontend, potentially allowing the attacker to steal administrator credentials, hijack sessions, or perform actions with elevated privileges. The vulnerability compromises confidentiality and integrity but does not affect availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and consider disabling or removing the Livemesh SiteOrigin Widgets plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.