CVE-2026-1572

The Livemesh Addons for Elementor plugin for WordPress versions up to 9.0 contains a Stored Cross-Site Scripting vulnerability combined with authorization bypass flaws. Authenticated attackers with Subscriber-level permissions can inject malicious scripts into plugin settings through the unprotected lae_admin_ajax() AJAX handler, which then execute when administrators access the settings page. The vulnerability requires attackers to obtain a valid nonce, which can be leaked due to the plugin's improper access control implementation. The vulnerability has a CVSS score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and low privileges, though user interaction is not necessary. The impact is limited to confidentiality and integrity compromises with no availability impact. The EPSS score of 0.00024 indicates this is a low-probability target compared to other known vulnerabilities, suggesting limited real-world exploitation likelihood. There are no current indications of active exploitation, as the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and remains inactive on exploit tracking lists. The moderate FAUCET risk score of 35.0 and low EPSS probability suggest community attention and exploit development are minimal. Organizations running the affected plugin should prioritize patching to version 9.1 or later to remediate both the authorization and output escaping issues.