PT-2026-33274 · WordPress · Livemesh Addons For Elementor

Published 2026-04-16 · Updated 2026-04-24 · CVE-2026-1572

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Livemesh Addons for Elementor versions prior to 9.1

Description The plugin allows unauthorized modification of data and Stored Cross-Site Scripting (XSS) through plugin settings. This occurs because the AJAX handler lae admin ajax() lacks authorization checks and multiple checkbox settings fields have insufficient output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts into the plugin settings page. These scripts execute when an administrator visits the page, provided the attacker obtains a valid nonce, which may be leaked due to improper access control on settings pages.

Recommendations Update to a version later than 9.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1572

Affected Products

Livemesh Addons For Elementor

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-1572 · Security Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/plugin.php#L207 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/admin/admin-ajax.php#L28 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/admin/admin-ajax.php#L28 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/admin/admin-ajax.php#L64 · Note
• https://twitter.com/CVEnew/status/2044701558605300106 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/admin/admin-ajax.php#L64 · Note
• https://twitter.com/VulmonFeeds/status/2044748502299742385 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/plugin.php#L207 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/admin/views/settings.php#L707 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/24b9bf5a-19ac-4e99-b32d-1ab681356a1b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/admin/views/settings.php#L707 · Note