TI-2021-06552 Aliases CVE-2021-24260 GHSA-rpxc-53j6-4h69

Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSS

LOW 26CWE-79Published 2021-05-05 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

Why it matters now

EPSS 0.00663 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Livemesh Addons for Elementor (Unknown): 6.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Livemesh Addons for Elementor	6.8 to before 6.8	6.8	Patch available	CNA

Livemesh Addons for Elementor VendorUnknown Affected 6.8 to before 6.8 Fixed in 6.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:livemeshelementor:addons_for_elementor::::::wordpress::*	before 6.8	Vulnerable	Livemeshelementor

cpe:2.3:a:livemeshelementor:addons_for_elementor:*:*:*:*:*:wordpress:*:* Versions before 6.8 Vulnerable ·Livemeshelementor

Remediation

Fix · CNA Livemesh Addons for Elementor (Unknown) Fixed in 6.8

Timeline

2026-10-02 Threatist record created from CVE-2021-24260
2026-10-03 Alias added: GHSA-rpxc-53j6-4h69
2026-10-06 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://wpscan.com/vulnerability/fa6c7c7c-1027-4fa9-bb55-07ae2bb7f021

Advisory 1

https://www.wordfence.com/blog/2021/04/recent-patches-rock-the-elementor-ecosystem/

TI-2022-03540 Livemesh Addons for Elementor < 7.2.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-02216 Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets CVSS 3.1HIGH 8.8
TI-2024-18587 WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
TI-2024-16826 WordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-02734 Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets CVSS 3.1MEDIUM 6.4
TI-2024-02470 Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name CVSS 3.1MEDIUM 6.4

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences