CVE-2026-14190 — Sina Extension for Elementor < 3.10.2 - Reflected XSS
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before refle…
Published: 2026-07-27 · CVSS: 6.1 · CVSS 3.1
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7