Stored Cross-Site Scripting Vulnerability in Elementor Addons by Livemesh for WordPress

CVE-2024-0448

What is CVE-2024-0448?

The Elementor Addons by Livemesh plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in its widget URL parameters. Authenticated attackers with contributor access or higher can exploit this flaw to inject arbitrary scripts into pages. These scripts will execute whenever a user accesses the compromised pages, potentially leading to unauthorized actions and data exposure.

References