CVE-2026-14190mediumCWE-79

CVE-2026-14190: medium-severity vulnerability in Sina Extension for Elementor

Sina Extension for Elementor < 3.10.2 - Reflected XSS

Published

Follow this CVE+ Monitor Sina Extension for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.1epss 0.3%
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Sina Extension for Elementor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sina Extension for Elementor

In the same product, most dangerous first.

CVE-2021-24269—Sina Extension for Elementor < 3.3.12 - Contributor+ Stored XSSEPSS 0.6%CVE-2026-83541MEDIUMSina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table WidgetEPSS 0.4%