Improper neutralization of input during web page generation allows the Sina Extension for Elementor plugin to store malicious script payloads entered by an attacker. This stored cross‑site scripting (XSS) flaw can execute arbitrary JavaScript in the browsers of any user who views content generated by the plugin, potentially enabling session hijacking, defacement, or malware delivery. The vulnerability is classified as CWE‑79 because the plugin fails to escape or validate user input before rendering it.

The affected product is the Sina Extension for Elementor plugin released by the vendor shaonsina. Versions through and including 3.6.1 are vulnerable; any deployment of the plugin that stores user‑supplied data in templates or pages until the upgrade to a fixed release will be affected. WordPress sites that use the plugin are therefore at risk if the plugin is still on or below 3.6.1.

The CVSS score of 7.6 places this issue in the high‑severity class, but an EPSS score of less than 1 % indicates that the likelihood of exploitation is currently very low and the vulnerability is not listed in CISA’s KEV catalog. Attackers would typically need to inject payloads through the plugin’s editing interface, generally requiring user or administrator privileges. While the risk is moderate due to the high severity, the low exploitation probability suggests that immediate action to remove the vulnerability is still prudent.