The vulnerability stems from insufficient input sanitization and output escaping in the Sina Posts, Sina Blog Post and Sina Table widgets, enabling an authenticated Contributor or administrator to store arbitrary JavaScript code in the plugin’s database fields. When a user visits a page containing the injected content, the stored script executes in the visitor’s browser. This stored XSS flaw allows attackers to run malicious client‑side code whenever the affected page is rendered.

WordPress sites that have installed the shaonsina Sina Extension for Elementor plugin. All plugin versions up to and including 3.7.0 contain the flaw. The affected components are the header builder, footer builder, theme builder, slider, gallery, form, modal, data table free Elementor widgets and Elementor templates that expose the vulnerable Sina Posts, Sina Blog Post and Sina Table widgets.

The CVSS base score of 6.4 indicates moderate severity, while an EPSS score of <1% reflects a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely abused. Attackers must be authenticated with Contributor level or higher access on the WordPress site to inject payloads, so the attack vector is limited to privileged users. However, once injected, the JavaScript will run for all visitors to the page, reflecting the potential impact on confidentiality and integrity of the site’s front‑end content.