The Sina Extension for Elementor plugin for WordPress is vulnerable to a stored cross-site scripting flaw caused by insufficient input sanitization and output escaping on user-supplied attributes in its Fancy Text, Countdown Widget, and Login Form shortcodes. This flaw lets an authenticated attacker with contributor-level or higher access inject arbitrary JavaScript into the plugin’s shortcode attributes, which is then stored in the database and executed in the context of any user who later visits an affected page. The resulting injection can compromise confidentiality and integrity by draining credentials, hijacking sessions, or maligning user sessions.

The affected product is the Sina Extension for Elementor plugin by shaonsina, available for WordPress. All releases up to and including version 3.6.0 are affected.

The CVSS score of 6.4 indicates a moderate severity vulnerability, while the EPSS score of less than 1 % suggests that exploitation is unlikely. The flaw is not listed in CISA KEV, implying that it is not a known, exploited vulnerability at the time of this analysis. Because the attack requires authenticated contributor-level access, the vector is limited to users who have already been granted writing privileges to the site or whose credentials have been compromised. Once an attacker injects malicious code through the vulnerable shortcodes, any subsequent visitor to the affected page will execute the script in their browser.