Livemesh Livemesh SiteOrigin Widgets

• CVE-2026-3896 Medium 6.4 Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting 0.2%
• CVE-2025-8780 Medium 6.4 Livemesh SiteOrigin Widgets <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets 0.2%