CVE-2026-1572

The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 9.0. This is due to missing authorization checks on the AJAX handler `lae_admin_ajax()` and insufficient output escaping on multiple checkbox settings fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever an administrator accesses the plugin settings page granted they can obtain a valid nonce, which can be leaked via the plugin's improper access control on settings pages.

• CWE-79

• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/admin/admin-ajax.php#L28
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/admin/admin-ajax.php#L64
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/admin/views/settings.php#L707
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/plugin.php#L207
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/admin/admin-ajax.php#L28
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/admin/admin-ajax.php#L64
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/admin/views/settings.php#L707
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/plugin.php#L207
• https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9bf5a-19ac-4e99-b32d-1ab681356a1b?source=cve

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15712A heap buffer over-read vulnerability was discovered in libs…5.9
• CVE-2026-15713A vulnerability was found in libsoup's HTTP/2 protocol imple…5.9
• CVE-2026-15714An out-of-bounds read vulnerability was found in libsoup's m…6.5
• CVE-2026-15715A vulnerability was identified in SourceCodester Class and E…4.3
• CVE-2026-15718We are aware that exploit code for this is public however we…4.3
• CVE-2026-15719We are aware that exploit code for this is public however we…5.4
• CVE-2026-15720In Open5GS through version 2.7.7 a pre-authentication heap o…8.6
• CVE-2026-15721Cleartext storage of sensitive information vulnerability in …9.8
• CVE-2026-15722A stack buffer overflow flaw was found in 389 Directory Serv…7.5
• CVE-2026-15724In Progress ShareFile Storage Zones Controller versions prio…8.7
• CVE-2026-15727The WP Bulk Delete plugin for WordPress is vulnerable to gen…4.9
• CVE-2026-1573The OMIGO plugin for WordPress is vulnerable to Stored Cross…6.4