What is the CVSS score of CVE-2026-39636?

CVE-2026-39636 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Livemesh Addons For Elementor CVE-2026-39636

EUVD-2026-20292 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Patchstack

GHSA-qv5m-7xm8-mwj3

WordPress XSS Livemesh Addons For Elementor Wordpress Plugin Livemesh

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:42 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20292

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.

AnalysisAI

Stored cross-site scripting (XSS) in Livemesh Addons for Elementor through version 9.0 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of administrators and other site visitors. The vulnerability stems from improper input sanitization during web page generation, enabling attackers to persistently compromise site functionality and steal administrative credentials or session tokens. CVSS 6.5 reflects moderate severity; EPSS 0.03% indicates very low real-world exploitation probability, suggesting this requires specific user interaction and authenticated access to exploit effectively.

Technical ContextAI

Livemesh Addons for Elementor is a WordPress plugin (CPE: cpe:2.3:a:livemesh:livemesh_addons_for_elementor:*:*:*:*:*:*:*:*) that extends the Elementor page builder with additional content modules and widgets. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-supplied input is not properly escaped or sanitized before being rendered in HTML output. This occurs during the plugin's web page generation phase-likely when processing widget content, shortcode parameters, or post metadata-allowing JavaScript payloads to be stored in the WordPress database and executed when the page is viewed by any user, including administrators.

RemediationAI

Upgrade Livemesh Addons for Elementor to a version greater than 9.0 (exact patched version not specified in available advisories; consult vendor release notes for the latest stable build). Users should also audit existing content within their WordPress site for any suspicious scripts or unusual widget configurations that may have been injected prior to patching. As a temporary workaround pending upgrade, restrict plugin access and widget editing permissions to highly trusted administrators only, and review user accounts and their capabilities to ensure that lower-privileged users cannot inject malicious content. Detailed remediation guidance is available via Patchstack at https://patchstack.com/database/Wordpress/Plugin/addons-for-elementor/vulnerability/wordpress-livemesh-addons-for-elementor-plugin-9-0-cross-site-scripting-xss-vulnerability.