CVE-2024-3639 is a stored cross-site scripting vulnerability in the Livemesh Addons by Elementor WordPress plugin, affecting all versions up to 8.3.7. The vulnerability is due to improper neutralization of input in the Posts Grid widget, specifically the 'grid_skin' attribute, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity), with an attack vector of network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts on confidentiality and integrity but not availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages via the Posts Grid widget's 'grid_skin' attribute. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, potentially compromising confidentiality and integrity of user data. Availability is not impacted. There are no known active exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Posts Grid widget. Monitor for plugin updates from Livemesh that address this vulnerability.