CVE-2026-14190
Deferred Deferred - Pending Action

Sina Extension for Elementor Reflected XSS via AJAX

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: WPScan

Description
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-08-16
AI Q&A
2026-07-27
EPSS Evaluated
2026-08-15
NVD
CVE-2026-14190
EUVD
EUVD-2026-49077

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_sina_extension elementor to 3.10.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin before version 3.10.2. It occurs because the plugin does not properly escape user input in an unauthenticated AJAX handler, allowing attackers to inject malicious JavaScript into the HTML response.

Detection Guidance

Check if the Sina Extension for Elementor plugin is installed and verify its version. If it is below 3.10.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect plugin files for version details.

Impact Analysis

An attacker can trick users into visiting a crafted link or page, causing malicious JavaScript to execute in their browser. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user.

Compliance Impact

This XSS vulnerability could expose user data to attackers, potentially violating GDPR (data protection) and HIPAA (health data privacy) by enabling unauthorized access or data breaches.

Mitigation Strategies

Update the Sina Extension for Elementor plugin to version 3.10.2 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart