CVE-2026-39636

CVE-2026-39636 is a Stored Cross-Site Scripting (XSS) vulnerability in Livemesh Addons for Elementor affecting versions 9.0 and earlier. This vulnerability allows authenticated users to inject malicious scripts that persist in the application, potentially compromising other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and user interaction. An authenticated attacker with low privileges can execute scripts in the context of other users' browsers, leading to limited confidentiality, integrity, and availability impacts. The FAUCET Risk Score of 35.0 indicates moderate concern within the broader vulnerability landscape. There is no evidence of active exploitation at this time. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and maintains an inactive status on threat intelligence hot lists. The Exploit Prediction Scoring System (EPSS) score of 0.00034 indicates minimal likelihood of exploitation, suggesting this vulnerability currently poses limited risk in real-world attack scenarios.