CVE-2024-1466 describes a stored cross-site scripting vulnerability in the Livemesh Addons by Elementor WordPress plugin, specifically via the 'slider_style' attribute of the Posts Multislider widget. The flaw allows authenticated users with contributor or higher privileges to inject arbitrary web scripts due to improper input sanitization and output escaping. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 8.3.4. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability and requires authenticated access with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Posts Multislider widget if feasible to reduce exposure.