Stored Cross-Site Scripting Vulnerability in Elementor Addons by Livemesh for WordPress

CVE-2024-1466

Summary

The Elementor Addons by Livemesh plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access or higher to inject malicious scripts via the 'slider_style' attribute of the Posts Multislider widget. This occurs due to the lack of proper input sanitization and output escaping in the affected functionalities. As a result, when users visit a page that has been compromised, the injected scripts execute, potentially leading to further exploitation of the site.

References