Livemesh SiteOrigin Widgets Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Livemesh SiteOrigin Widgets plugin for WordPress, affecting all versions through 3.9.2. The issue arises from missing authorization checks and inadequate input sanitization in the 'lsow_admin_ajax' AJAX action. While the AJAX handler verifies a nonce, it fails to check user capabilities, allowing authenticated attackers with Subscriber-level access and above to alter plugin settings and inject malicious scripts. These scripts execute when administrators access the plugin settings page or when any user visits the frontend.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.