The vulnerability CVE-2026-39636 in Livemesh Addons for Elementor is a stored cross-site scripting flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that are stored and later executed in users' browsers when they view the affected content. The vulnerability affects all versions up to 9.0. No CVSS score or vendor advisory with patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to session hijacking, defacement, or other malicious actions depending on the victim's privileges. However, no known exploits are reported in the wild, and the exact impact depends on the usage context of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.