CVE-2024-1461: 
WordPress vulnerability analysis and mitigation

The Elementor Addons by Livemesh plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1461) in versions up to and including 8.3.4. The vulnerability was discovered on March 13, 2024, and last updated on April 9, 2024, affecting the Team Members widget functionality (Wordfence Intel).

The vulnerability exists due to insufficient input sanitization and output escaping in the 'style' attribute of the Team Members widget. The vulnerability has been assigned a CVSS score of 6.4 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence Intel).

When exploited, this vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (Wordfence Intel).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attacker must have access to the Team Members widget functionality to inject malicious scripts (Wordfence Intel).

Users are advised to update to version 8.3.6 or newer to patch this vulnerability. This version contains the necessary fixes to address the input sanitization and output escaping issues (Wordfence Intel).