CVE-2024-3638: 
WordPress vulnerability analysis and mitigation

The Elementor Addons by Livemesh plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-3638) affecting versions up to and including 8.3.7. The vulnerability exists in multiple widgets including the Marquee Text Widget, Testimonials Widget, and Testimonial Slider widgets due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 5.4 (MEDIUM) according to NVD's assessment (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Wordfence has assigned a slightly higher CVSS score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring network access and no special conditions for exploitation (NVD).