The vulnerability allows a stored cross‑site scripting (XSS) flaw in the Livemesh Addons for Elementor plugin, enabling an attacker to inject malicious scripts that execute in the browsers of visitors. This could lead to session hijacking, theft of sensitive data, inappropriate UI changes, or further distribution of malware. The weakness corresponds to CWE‑79 – Improper Neutralization of Input During Web Page Generation.

WordPress sites that use the Livemesh Addons for Elementor plugin from any version through 9.0, supplied by the vendor Livemesh. Any installation of these affected versions is susceptible.

The CVSS base score of 6.5 classifies the flaw as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker or a user with content‑creation permissions could embed malicious data that the plugin stores and later serves to site visitors. Exploitation requires the attacker’s input to be accepted and rendered by the plugin, leading to arbitrary script execution in users’ browsers. Due to its storage nature, the impact is limited to compromised visitors rather than the server itself.