Medium severity · published Jul 27, 2026
CVE-2026-14190
Sina Extension for Elementor < 3.10.2 - Reflected XSS
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sina Extension for Elementor ·
before 3.10.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14190
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14190
wpscan.com
https://wpscan.com/vulnerability/9b855913-a55e-469d-b3cd-324c31b0d4d8/
More from Sina Extension for Elementor
6.8
CVE-2026-83541
Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget