A stored cross‑site scripting flaw allows a contributor to embed malicious JavaScript into content managed by the WordPress editor. When site visitors load the affected page, the embedded code runs in their browser, potentially enabling cookie theft, session hijacking, or phishing attempts. The vulnerability is cataloged as CWE‑79.

WordPress sites that have installed Livemesh Addons for WPBakery Page Builder version 3.9.4 or earlier are impacted. Because the plugin bundles with the WPBakery Page Builder framework, any site using this bundle can run the flaw. Contributors who have permission to create or edit posts can inject the script, and all visitors to the resulting pages become exposed.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% suggests a low probability of widespread exploitation at this time. Because the flaw is stored XSS, an attacker who can add content will affect every subsequent viewer of that page. The vulnerability is not listed in the CISA KEV catalog, so no evidence of active exploitation is known. Based on the nature of stored XSS, the likely attack vector is the WordPress content editor accessed by contributor accounts, which does not require server compromise.