CVE-2026-3897 is a stored XSS vulnerability in the Livemesh Addons for Beaver Builder WordPress plugin affecting all versions up to 3.9.2. The vulnerability is caused by missing authorization checks in the `labb_admin_ajax` AJAX action, which only verifies a nonce but fails to check user capabilities. This allows authenticated users with low privileges (Subscriber-level and above) to modify plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend, potentially leading to privilege escalation or session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Subscriber-level or higher access can exploit this vulnerability to inject persistent malicious scripts into the plugin settings. These scripts execute in the context of administrators or site visitors, potentially allowing the attacker to steal credentials, hijack sessions, or perform actions with elevated privileges. The vulnerability compromises confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin access to trusted users only and consider disabling or removing the Livemesh Addons for Beaver Builder plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.