Stored XSS and Data Modification Risk in Livemesh Addons for Elementor by WordPress

CVE-2026-1572

What is CVE-2026-1572?

The Livemesh Addons for Elementor plugin for WordPress is susceptible to stored Cross-Site Scripting (XSS) and unauthorized data modifications. This vulnerability arises from inadequate authorization checks within the AJAX handler lae_admin_ajax() and insufficient output escaping in various checkbox settings fields. As a result, authenticated attackers with Subscriber-level access can inject arbitrary scripts into the plugin settings page. The risks intensify when administrators access these settings, where the malicious scripts execute if attackers obtain a valid nonce due to poor access control.

References