Vulnerability in Livemesh Addons By Elementor
CVE-2026-1620
The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0. This is due to insufficient sanitization of the template name parameter in the `lae_get_template_part()…
EPSS: 0.001 (26.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Livemesh Addons By Elementor — versions 0
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/2483875a-84de-4a40-a69e-aee68…
- plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/includes/helper-f…
- plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/includes/helpe…
- plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/includes/helper-f…
- plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/includes/helpe…
Frequently asked questions
- What is CVE-2026-1620?
- CVE-2026-1620 is a high-severity vulnerability in Livemesh Addons By Elementor, classified under PHP Remote File Inclusion. CVSS score: 8.8/10. Published 2026-04-16.
- How severe is CVE-2026-1620?
- High severity. CVSS v3 base score is 8.8 out of 10.