WordPress security by component

Sina Extension for Elementor

Plugin description

Sina Extension for Elementor is a WordPress component with 17 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 7.6.

Plugin slug: sina-extension-for-elementor

Latest vulnerability

CVE-2026-14190: Sina Extension AJAX responses permit reflected XSS

Sina Extension for Elementor before 3.10.2 exposes an unauthenticated AJAX handler that reconstructs a caller-controlled request value and reflects it without safe output escaping. An attacker can place script in a crafted request and execute it in the affected site's origin when a victim follows or submits that request. The CNA record does not disclose the AJAX action, parameter or vulnerable function.

PublishedJul 27, 2026

Known safe version3.10.2

		Safe version
Jul 27, 2026	CVE-2026-14190 Sina Extension AJAX responses permit reflected XSS Sina Extension for Elementor before 3.10.2 exposes an unauthenticated AJAX handler that reconstructs a caller-controlled request value and reflects it without safe output escaping. An attacker can place script in a crafted request and execute it in the affected site's origin when a victim follows or submits that request. The CNA record does not disclose the AJAX action, parameter or vulnerable function.	3.10.2	CVE6.1 NVDPending
Mar 23, 2026	CVE-2025-6229 Sina Extension for Elementor: Cross-site scripting Sina Extension for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.7.0.	> 3.7.0	CVE6.4 NVDPending
Aug 01, 2025	CVE-2025-6228 Sina Extension For Elementor: Cross-site scripting Sina Extension For Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVDPending
Jun 06, 2025	CVE-2025-49262 Sina Extension for Elementor: Cross-site scripting Sina Extension for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.6 NVD5.4
Feb 26, 2025	CVE-2025-1517 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates): Cross-site scripting Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Jan 07, 2025	CVE-2024-12624 Sina Extension for Elementor: Cross-site scripting Sina Extension for Elementor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Oct 16, 2024	CVE-2024-9540 Sina Extension for Elementor: Sensitive information exposure Sina Extension for Elementor is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE4.3 NVD4.3
Jul 02, 2024	CVE-2024-5260 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates): Cross-site scripting Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Jun 20, 2024	CVE-2024-5036 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates): Cross-site scripting Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Jun 08, 2024	CVE-2024-35703 Sina Extension for Elementor: Cross-site scripting Sina Extension for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Jun 04, 2024	CVE-2024-34384 Sina Extension for Elementor: Filesystem traversal Sina Extension for Elementor is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE6.5 NVD8.8
May 15, 2024	CVE-2024-4373 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates): Cross-site scripting Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
May 14, 2024	CVE-2024-4333 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates): Cross-site scripting Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 25, 2024	CVE-2024-3988 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates): Cross-site scripting Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Mar 27, 2024	CVE-2024-29935 Sina Extension for Elementor: Cross-site scripting Sina Extension for Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
May 05, 2021	CVE-2021-24269 “Sina Extension for Elementor”: Cross-site scripting “Sina Extension for Elementor” is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Aug 30, 2019	CVE-2019-15839 Sina Extension For Elementor: Filesystem traversal Sina Extension For Elementor is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5 NVD7.5