The Livemesh SiteOrigin Widgets plugin contains a stored cross‑site scripting flaw in its Hero Header and Pricing Table widgets. Insufficient input sanitization and output escaping on user‑supplied attributes allow an attacker to embed arbitrary JavaScript into the page’s HTML. Once a contributor‑level or higher user uploads the malicious content, every viewer of the affected page will execute the injected script. The weakness aligns with CWE‑79.

WordPress sites running the Livemesh SiteOrigin Widgets plugin, versions 3.9.1 and earlier. The vulnerability exists across all releases up to and including 3.9.1; newer releases remove the unchecked input paths. Affected installations include those where the plugin’s Hero Header or Pricing Table widgets are active and editable by users with contributor‑level permissions or higher.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests the flaw is not widely exploited at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to possess credentials with contributor-level access or higher, as the injection can only occur when a user edits the widget’s attributes. Once injected, the malicious script executes for all visitors who load the affected page. Environments lacking contributor roles are less exposed, while sites that grant broad contributor permissions remain at higher risk.