EUVD-2026-23203Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 9.0. This is due to missing authorization checks on the AJAX handler lae_admin_ajax() and insufficient output escaping on multiple checkbox settings fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever an administrator accesses the plugin settings page granted they can obtain a valid nonce, which can be leaked via the plugin's improper access control on settings pages.
AnalysisAI
Livemesh Addons for Elementor plugin versions up to 9.0 allow authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via the plugin settings page through missing authorization checks on the AJAX handler lae_admin_ajax() and insufficient output escaping on checkbox fields. The injected scripts execute whenever an administrator accesses the settings page if the attacker obtains a valid nonce, which can be leaked due to improper access control on settings pages. This combination of authorization bypass and stored XSS affects all WordPress installations running the vulnerable plugin.
Technical ContextAI
The vulnerability exists in the Livemesh Addons for Elementor WordPress plugin's administrative AJAX handler. The lae_admin_ajax() function in admin/admin-ajax.php fails to verify user capabilities before processing settings modifications, allowing any authenticated user (Subscriber level and above) to submit arbitrary data to the plugin settings. Additionally, checkbox settings fields in admin/views/settings.php lack proper output escaping when rendering stored values, enabling stored XSS attacks. The root cause is twofold: CWE-79 (Improper Neutralization of Input During Web Page Generation) combined with missing authorization checks. The nonce leak vulnerability stems from improper access control on the settings page itself, exposing the security token needed to carry out the attack. This is a typical WordPress plugin vulnerability pattern where AJAX endpoints check for nonce validity but fail to verify appropriate user capabilities or roles for the specific action being performed.
RemediationAI
The primary remediation is to update the Livemesh Addons for Elementor plugin to a patched version beyond 9.0 as soon as the vendor releases it; however, no specific patched version number is provided in the available data, so administrators should monitor the plugin's WordPress repository page and Wordfence vulnerability database at https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9bf5a-19ac-4e99-b32d-1ab681356a1b for patch availability. Until a patch is released, the following compensating controls mitigate exploitation: first, disable user registration on the WordPress site to eliminate Subscriber-level access creation, though this removes a core WordPress feature and should only be applied if user-generated content is not required; second, restrict access to wp-admin entirely for non-administrator roles using a web application firewall or .htaccess rules, which prevents low-privileged users from accessing the settings page where nonce leaks occur; third, implement strict Content Security Policy (CSP) headers to block inline script execution, reducing XSS impact even if injection succeeds-however, many WordPress plugins conflict with CSP directives, so thorough testing is required before deployment. Wordfence recommends checking their advisory at the provided link for additional guidance and timeline information on patch availability.
More in Livemesh Addons By Elementor
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today