CVE-2024-3638

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marquee Text Widget, Testimonials Widget, and Testimonial Slider widgets in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-363835.3An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML CVE-2024-363846.1Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.CVE-2024-363875.4Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server pr CVE-2024-363889.8MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function CVE-2024-363899.8MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass CVE-2024-36395.4The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Posts Grid widget in al CVE-2024-363907.5MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service CVE-2024-363917.4MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic CVE-2024-363926.1MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-363939.8SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-363949.8SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-363956.1Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)