CVE-2026-1572: XSS in Livemesh Addons for Elementor

An attacker exploiting CVE-2026-1572 can inject malicious JavaScript code into the Livemesh Addons for Elementor plugin settings. Because the vulnerability requires only Subscriber-level access, a relatively low-privilege user could potentially compromise the entire WordPress administration interface. The injected script would execute whenever an administrator accesses the plugin settings page. This could be used to steal administrator credentials, redirect users to phishing sites, deface the website, or inject malware. The blast radius extends to any data accessible to the administrator, including user data, database credentials, and sensitive configuration files. While the vulnerability requires authentication, the relatively low access level needed makes it a significant risk, particularly for sites with a large number of users or sensitive data.

1. Reserved2026-01-28
2. Published2026-04-16
3. Modified2026-04-22
4. EPSS updated2026-04-23

The primary mitigation for CVE-2026-1572 is to upgrade to a patched version of the Livemesh Addons for Elementor plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. One approach is to restrict access to the plugin settings page to only administrators with a strong need to modify them. Implement a Web Application Firewall (WAF) with rules to detect and block suspicious JavaScript code being submitted through AJAX requests to the laeadminajax() endpoint. Review and sanitize all user inputs related to plugin settings, focusing on checkbox fields. Regularly scan the WordPress installation for malicious code and unauthorized modifications. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a plugin setting and verifying that it does not execute.

Active installs

40KKnown

Plugin rating