CVE-2024-1235 is a stored cross-site scripting vulnerability (CWE-79) in the Livemesh Addons by Elementor WordPress plugin, affecting all versions up to and including 8.3.2. The flaw exists in the handling of the custom class field, where input is not properly sanitized or escaped, allowing authenticated users with contributor-level access or higher to inject arbitrary JavaScript code. This code executes in the context of users who visit the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. There is no information about available patches or vendor advisories in the provided data.

An attacker with contributor or higher privileges can inject malicious scripts into pages via the custom class field. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of user credentials, session tokens, or other malicious actions limited to the scope of the injected script. The vulnerability does not affect availability and requires authenticated access, but it compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable plugin. Monitor official Livemesh or Elementor channels for updates and apply any released patches promptly.