The vulnerability is a stored cross‑site scripting flaw in WPBakery Page Builder Addons by Livemesh, affecting all plugin versions up to and including 3.9.4. The flaw arises from inadequate sanitization of shortcode attributes, which are encoded with wp_json_encode() and inserted into single‑quoted data-settings attributes without esc_attr() escaping. Because the attributes are not escaped, an authenticated user with Contributor or higher role can inject single quotes and break out of the attribute to embed arbitrary JavaScript, which will run whenever a page containing the shortcode is viewed by any user.

The affected system is the Livemesh WPBakery Page Builder Addons WordPress plugin, versions 3.9.4 and below. Administrators or those with Contributor‑level permissions on a WordPress site that has this plugin installed are at risk; any page that uses the [lvca_carousel] or [lvca_posts_carousel] shortcodes can become a vector for the script injection.

The CVSS base score is 6.4, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no publicly documented active exploitation. Because the flaw requires authenticated access, an attacker must be able to log in with Contributor or higher privileges and manipulate content, which is a common capability on many managed WordPress installations. However, once injected, the malicious script will be served to all site visitors, potentially compromising confidentiality and integrity of the site’s content.