The Livemesh Addons for Beaver Builder plugin for WordPress contains a Stored XSS flaw in the `[labb_pricing_item]` shortcode. When the shortcode’s `title` and `value` attributes are supplied, the plugin first sanitizes the input with `wp_kses_post()` and then undecodes it with `htmlspecialchars_decode()`. This bypasses the sanitization, allowing an authenticated Contributor or higher to inject arbitrary JavaScript that executes whenever any user views the page. An attacker could steal session cookies, deface content, or perform other malicious client‑side actions, breaking confidentiality, integrity, and potentially availability of the site. The flaw aligns with CWE‑79.

All installations of the Livemesh Addons for Beaver Builder plugin with version 3.9.2 or earlier are affected. The vulnerability exists in the plugin’s core module that processes the `[labb_pricing_item]` shortcode within WordPress pages and posts.

The CVSS v3 base score is 6.4, indicating moderate severity. The EPSS score is below 1 %, reflecting a low probability that the vulnerability is actively exploited at present, and the flaw is not yet listed in the CISA KEV catalog. An attacker must be authenticated with Contributor‑level or higher privileges to inject malicious payloads. Once injected, the script runs for all visitors to the affected page, making the risk of credential theft or defacement significant if the attacker gains such access.