Livemesh Addons by Elementor

Livemesh Addons by Elementor has 24 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; 21 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2024 was the busiest year with 16 disclosures.

The most common weakness is Cross-Site Scripting, behind 20 of the records (83%). Other recurring categories include Missing Authorization, Path Traversal.

21 of the records (88%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2026.

15 independent researchers contributed these findings, most of them (4) reported by Webbernaut.

01234567891025.02.2019Today25.02.20198.8Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update CVSS 8.8 · 25.02.201913.04.20215.4Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting CVSS 5.4 · 13.04.202104.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202221.11.20225.5Livemesh Addons for Elementor <= 7.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 5.5 · 21.11.202218.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202325.01.20246.4Elementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 25.01.202407.02.20246.4Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 07.02.202412.02.20246.4Livemesh Addons for Elementor <= 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via animated_text_class CVSS 6.4 · 12.02.202413.03.20246.4Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget CVSS 6.4 · 13.03.20246.4Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget CVSS 6.4 · 13.03.20246.4Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget CVSS 6.4 · 13.03.20246.4Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget CVSS 6.4 · 13.03.20246.4Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget CVSS 6.4 · 13.03.202409.04.20246.4Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute CVSS 6.4 · 09.04.20246.4Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name CVSS 6.4 · 09.04.202403.07.20246.4Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid CVSS 6.4 · 03.07.20248.8Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets CVSS 8.8 · 03.07.20246.4Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets CVSS 6.4 · 03.07.20246.4Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets CVSS 6.4 · 03.07.202424.09.20246.4Elementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter CVSS 6.4 · 24.09.202425.09.20246.4Livemesh Addons for Elementor <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 25.09.202413.02.20266.4Livemesh Addons for Elementor <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 13.02.202615.04.20268.8Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter CVSS 8.8 · 15.04.20266.4Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings CVSS 6.4 · 15.04.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage88%
Open

3

Fixed

21

Get automatic notifications for all Livemesh Addons by Elementor vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2026-1620

Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter

Read the full analysis

Vulnerability Records

24 records
2026-04-15 17:57
Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings
Livemesh Addons by Elementor
<= 9.0
CVE-2026-1572
6.4
Medium
Muhammad Yudha - DJNo
2026-04-15 17:56
Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter
Livemesh Addons by Elementor
<= 9.0
CVE-2026-1620
8.8
High
WebbernautNo
2026-02-13 00:00
Livemesh Addons for Elementor <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Livemesh Addons by Elementor
<= 9.0
CVE-2026-39636
6.4
Medium
Athiwat Tiprasaharn (Jitlada)No
2024-09-25 00:00
Livemesh Addons for Elementor <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Livemesh Addons by Elementor
<= 8.5
CVE-2024-47303
6.4
Medium
João Pedro Soares de AlcântaraYes
2024-09-24 21:40
Elementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter
Livemesh Addons by Elementor
<= 8.5
CVE-2024-8858
6.4
Medium
stealthcopterYes
2024-07-03 14:51
Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets
Livemesh Addons by Elementor
<= 8.4
CVE-2024-2385
8.8
High
wesley (wcraft)Yes
2024-07-03 14:51
Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets
Livemesh Addons by Elementor
<= 8.4.1
CVE-2024-3638
6.4
Medium
WebbernautYes
2024-07-03 14:51
Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets
Livemesh Addons by Elementor
<= 8.3.7
CVE-2024-2926
6.4
Medium
wesley (wcraft)Yes
2024-07-03 00:00
Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid
Livemesh Addons by Elementor
<= 8.3.7
CVE-2024-3639
6.4
Medium
Ngô Thiên An (ancorn_)Yes
2024-04-09 00:00
Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute
Livemesh Addons by Elementor
<= 8.3.6
CVE-2024-2539
6.4
Medium
Ngô Thiên An (ancorn_)Yes
Showing 1–10 of 24 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C