Sina Extension For Elementor Vulnerabilities

The Sina Extension for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they ca...

CVSS:

6.1

Affected:

up to 3.10.1

Fixed in:

3.10.2

Disclosed:

Jul 6, 2026

CVE-2026-14190 on NVD →

Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget` vulnerability

CVSS:

6.5

Affected:

up to 3.7.0

Fixed in:

3.7.1

Disclosed:

Mar 24, 2026

The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Fancy Text Widget` And `Countdown Widget` DOM attributes in all versions up t...

CVSS:

6.4

Affected:

up to 3.7.0

Fixed in:

3.7.1

Disclosed:

Mar 22, 2026

CVE-2025-6229 on NVD →

The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Table` widgets in all versions up to,...

CVSS:

6.4

Affected:

up to 3.7.0

Fixed in:

3.7.1

Disclosed:

Jul 31, 2025

CVE-2025-6228 on NVD →

The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web sc...

CVSS:

5.5

Affected:

up to 3.6.1

Fixed in:

3.7.0

Disclosed:

Jun 5, 2025

CVE-2025-49262 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0...

CVSS:

6.4

Affected:

up to 3.6.0

Fixed in:

3.6.1

Disclosed:

Feb 25, 2025

CVE-2025-1517 on NVD →

The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attac...

CVSS:

6.4

Affected:

up to 3.5.91

Fixed in:

3.6.0

Disclosed:

Jan 6, 2025

CVE-2024-12624 on NVD →

The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the render function in widgets/advanced/sina-modal-box.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensit...

CVSS:

4.3

Affected:

up to 3.5.7

Fixed in:

3.5.8

Disclosed:

Oct 15, 2024

CVE-2024-9540 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘read_more_text’ parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization...

CVSS:

6.4

Affected:

up to 3.5.5

Fixed in:

3.5.6

Disclosed:

Jul 1, 2024

CVE-2024-5260 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.5.4 due to insufficient input sanitization and output...

CVSS:

6.4

Affected:

up to 3.5.4

Fixed in:

3.5.5

Disclosed:

Jun 19, 2024

CVE-2024-5036 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Particle Layer widget in all versions up to, and including, 3.5.3 due to insufficient input san...

CVSS:

6.4

Affected:

up to 3.5.3

Fixed in:

3.5.4

Disclosed:

May 14, 2024

CVE-2024-4373 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficient input sanitization and output e...

CVSS:

6.4

Affected:

up to 3.5.3

Fixed in:

3.5.4

Disclosed:

May 13, 2024

CVE-2024-4333 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with contributor-level acce...

CVSS:

8.8

Affected:

up to 3.5.1

Fixed in:

3.5.2

Disclosed:

May 3, 2024

CVE-2024-34384 on NVD →

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to insufficient input sanitiz...

CVSS:

6.4

Affected:

up to 3.5.2

Fixed in:

3.5.3

Disclosed:

Apr 24, 2024

CVE-2024-3988 on NVD →

The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scri...

CVSS:

6.4

Affected:

up to 3.5.0

Fixed in:

3.5.1

Disclosed:

Mar 25, 2024

CVE-2024-29935 on NVD →

The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS:

5.4

Affected:

up to 3.3.12

Fixed in:

3.3.12

Disclosed:

Apr 13, 2021

CVE-2021-24269 on NVD →

The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.

CVSS:

9.8

Affected:

up to 2.2.1

Fixed in:

2.2.1

Disclosed:

Jun 19, 2019

CVE-2019-15839 on NVD →