The Livemesh SiteOrigin Widgets plugin for WordPress permits authenticated users with Subscriber or higher capabilities to execute stored cross‑site scripting through the lsow_admin_ajax AJAX action. The action verifies a nonce but omits a capability check, allowing the authenticated attacker to alter plugin settings and embed arbitrary scripts that run when an administrator opens the plugin settings page or any visitor loads the front‑end. This stored XSS can compromise the integrity of the site content and potentially expose site information.

The vulnerability exists in all Livemesh SiteOrigin Widgets versions up to and including 3.9.2. Any WordPress installation that has this plugin installed and has users with Subscriber‑level roles or above is vulnerable.

The CVSS score of 6.4 indicates moderate severity. The flaw is not listed in CISA KEV and its EPSS score is not available, suggesting no known widespread exploitation at the time of analysis. An attacker requires remote access to the WordPress admin interface and possession of an authenticated account with Subscriber or higher capability. With these prerequisites, the attacker can inject malicious scripts that will execute on subsequent visits to the plugin settings page or the site’s front‑end, compromising site integrity and potentially exposing data.