The Livemesh Addons for Elementor plugin is vulnerable due to missing authorization checks on the AJAX handler lae_admin_ajax and insufficient escaping of checkbox settings. This allows a Subscriber or higher authenticated attacker with a valid nonce to store malicious JavaScript in the plugin’s settings. When an administrator later visits the settings page, the injected script executes in the admin’s browser, potentially enabling session hijacking, defacement, or other client‑side attacks.

All versions of the Livemesh Addons for Elementor plugin up to and including 9.0, used on WordPress sites. The vulnerability exists in the plugin’s backend AJAX handling and settings pages, affecting any WordPress installation that has the plugin installed and permits Subscribers or higher to access the settings area.

The vulnerability carries a CVSS score of 6.4, indicating a moderate risk. The exploitation probability is not provided. The flaw is not included in the CISA known exploited vulnerabilities catalog. Exploitation requires an authenticated user with at least Subscriber level access who can obtain a plugin‑generated nonce; once the nonce is known, the attacker can inject arbitrary script that is stored and later executed for any administrator that views the settings page. Because the attacker must be authenticated, the attack surface is limited to trusted users, yet the consequences for administrative accounts can be severe if the malicious code runs in their session.