Elementor Addons by Livemesh Vulnerability – Authenticated Stored Cross-Site Scripting via Posts Multislider Widget – CVE-2024-1466 | WordPress Plugin Vulnerability Report 

Plugin Name: Elementor Addons by Livemesh

Key Information:

  • Software Type: Plugin
  • Software Slug: addons-for-elementor
  • Software Status: Active
  • Software Author: livemesh
  • Software Downloads: 3,775,245
  • Active Installs: 70,000
  • Last Updated: March 14, 2024
  • Patched Versions: 8.3.6
  • Affected Versions: <= 8.3.4

Vulnerability Details:

  • Name: Elementor Addons by Livemesh <= 8.3.4
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1466
  • CVSS Score: 6.4
  • Publicly Published: March 13, 2024
  • Researcher: Drian - Pato Academy
  • Description: The plugin is vulnerable to Stored Cross-Site Scripting (XSS) through the 'slider_style' attribute of the Posts Multislider widget, due to inadequate input sanitization and output escaping. This vulnerability allows authenticated users with at least contributor-level access to insert and execute harmful scripts, compromising site security and user safety.


Elementor Addons by Livemesh, a widely utilized plugin providing additional widgets and functionalities for Elementor, has been found vulnerable in versions up to and including 8.3.4. This vulnerability, identified as CVE-2024-1466, enables Authenticated Stored Cross-Site Scripting attacks, putting WordPress sites at risk. The issue has been addressed in the latest version 8.3.6, enhancing the plugin's security framework.

Detailed Overview:

Discovered by researcher Drian from Pato Academy, CVE-2024-1466 sheds light on the critical necessity of stringent input sanitization in web development, particularly in plugins offering dynamic content capabilities like Elementor Addons by Livemesh. The potential for attackers to exploit this vulnerability underscores the importance of robust security practices in plugin development and WordPress site management.

Advice for Users:

  • Immediate Action: Update the Elementor Addons by Livemesh plugin to version 8.3.6 promptly to safeguard against this vulnerability.
  • Check for Signs of Vulnerability: Administrators should monitor their site for unexpected script executions or content changes, especially in areas utilizing the Posts Multislider widget, as these may indicate exploitation.
  • Alternate Plugins: While the updated version is deemed secure, users may consider exploring other Elementor addons for enhanced features or different security assurances.
  • Stay Updated: Regularly updating all WordPress elements, including plugins, themes, and the core, is paramount in maintaining site security and functionality.


The resolution of CVE-2024-1466 in the Elementor Addons by Livemesh plugin serves as a vital reminder of the ongoing need for vigilance and proactive security measures within the WordPress ecosystem. For WordPress site administrators, particularly those managing small businesses with limited technical resources, the commitment to timely software updates and adherence to security best practices is essential in protecting digital assets against evolving threats.



In the rapidly evolving digital landscape, the security of your WordPress site can never be overemphasized. The recent discovery of a vulnerability in the widely used Elementor Addons by Livemesh underscores this critical point. Identified as CVE-2024-1466, this vulnerability exposes sites to potential Stored Cross-Site Scripting (XSS) attacks, highlighting the ever-present need for vigilance and regular updates.

About the Plugin:

Elementor Addons by Livemesh enhances Elementor with additional widgets and functionalities, boasting over 70,000 active installations. However, versions up to 8.3.4 have been compromised due to insufficient input sanitization and output escaping within the Posts Multislider widget's 'slider_style' attribute. This flaw allows authenticated users with contributor-level access or higher to execute harmful scripts, posing a threat to site security and user data.

Vulnerability Insights:

Drian from Pato Academy, the researcher who unearthed CVE-2024-1466, emphasizes the importance of robust input validation and encoding in web development. This vulnerability not only puts websites at risk but also serves as a stark reminder of the potential for exploitation, even by users with relatively low-level access.

Mitigating the Risk:

The prompt release of version 8.3.6 by Livemesh patches this vulnerability, restoring the security integrity of the plugin. Site administrators are urged to update immediately and remain vigilant for any signs of unauthorized script executions or content alterations, especially in areas utilizing the Posts Multislider widget.

Proactive Measures:

While the patched version addresses this specific vulnerability, exploring alternative Elementor addons might provide additional functionalities or different security features. Keeping all WordPress components updated is crucial for protecting against known vulnerabilities and ensuring optimal site performance.

Reflecting on Past Vulnerabilities:

The Elementor Addons by Livemesh plugin has encountered 12 vulnerabilities since February 25, 2019. Each instance serves as a learning opportunity, reinforcing the importance of continuous monitoring and updates in the realm of WordPress site management.


The resolution of CVE-2024-1466 in Elementor Addons by Livemesh is a crucial reminder of the ongoing challenge of cybersecurity. For small business owners and WordPress site administrators, especially those with limited technical support, maintaining a proactive stance towards software updates and security best practices is fundamental. In doing so, they not only protect their digital assets but also sustain the trust of their users in an increasingly complex cybersecurity landscape.

Stay Informed, Stay Secure:

Keeping abreast of the latest vulnerabilities and updates can be daunting, but it is essential for the security of your WordPress site. Utilizing resources like Wordfence and adhering to recommended security measures can significantly mitigate the risk of potential threats.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Elementor Addons by Livemesh Vulnerability – Authenticated Stored Cross-Site Scripting via Posts Multislider Widget – CVE-2024-1466 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment