CVE-2022-3862 Livemesh Addons for Elementor < 7.2.4 - Admin+ Stored XSS

2022-12-1217:54:57

WPScan

www.cve.org

livemesh addons

elementor

stored xss

cve-2022-3862

wordpress

plugin

settings

cross-site scripting

admin

privilege users

unfiltered html

multisite setup

EPSS

0.001

Percentile

25.0%

JSON

The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Livemesh Addons for Elementor",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "7.2.4"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/3db9a8f5-3335-4b8d-a067-091cbfed1efc

EPSS

0.001

Percentile

25.0%

JSON

Related for CVELIST:CVE-2022-3862