WordPress Plugin Vulnerabilities

Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget

Description

The plugin does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
sina-extension-for-elementor
Fixed in 3.10.4

References

CVE
CVE-2026-83541

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org/
Verified
Yes
WPVDB ID
3bd0cd85-9fc2-4111-a626-cc4d8daa6977

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2026-02-09
Title
The Events Calendar Shortcode & Block < 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2024-03-22
Title
Move Addons for Elementor < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-10-24
Title
Import and export users and customers < 1.27.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-09-30
Title
Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting
Published
2024-03-25
Title
Image Hover Effects – Elementor Addon < 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'eihe_align'