What is the CVSS score of CVE-2025-49262?

CVE-2025-49262 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Sina Extension For Elementor are affected by CVE-2025-49262?

A stored cross-site scripting (XSS) vulnerability in the Sina Extension for Elementor (versions up to 3.6.1) allows attackers to inject malicious code that persists in web pages and executes in…

How to fix or mitigate CVE-2025-49262?

Within 24 hours: Audit all sites using Sina Extension for Elementor and document affected instances; disable the plugin on non-critical environments pending remediation. Within 7 days: Implement input validation and output encoding controls via WAF rules; review access logs for signs of exploitation. Within 30 days: Either apply a vendor patch when released, replace the plugin with an alternative, or maintain compensating controls with enhanced monitoring and regular security assessments.

Sina Extension For Elementor CVE-2025-49262

EUVD-2025-17285 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 audit@patchstack.com

WordPress XSS Sina Extension For Elementor Wordpress Plugin Elementor Sinaextra

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

MEDIUM HIGH

CVSS changed

Apr 23, 2026 - 15:42 NVD

5.4 (MEDIUM) 7.6 (HIGH)

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17285

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shaonsina Sina Extension for Elementor allows Stored XSS. This issue affects Sina Extension for Elementor: from n/a through 3.6.1.

AnalysisAI

Stored Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin (versions up to 3.6.1) that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When victims view the affected pages, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or defacement. While the CVSS score of 7.6 indicates moderate-to-high severity, the requirement for high-privilege authentication (PR:H) significantly limits exploitation scope compared to unauthenticated XSS vulnerabilities.

Technical ContextAI

This vulnerability stems from improper input neutralization during web page generation (CWE-79: Improper Neutralization of Input During Web Page Generation). The Sina Extension for Elementor is a WordPress plugin that extends the Elementor page builder with additional functionality. The vulnerability likely exists in custom widgets or output functions where user-controlled input (possibly from element settings, custom fields, or shortcode parameters) is rendered directly into page HTML without adequate sanitization or escaping. The affected component processes data during the page rendering pipeline without properly neutralizing special characters or HTML entities, allowing XSS payload injection. This is a Stored XSS variant, meaning the malicious payload persists in the database and executes for all users viewing the affected page, rather than requiring a crafted URL.

RemediationAI

patch: WordPress Admin > Plugins > Updates, or download from https://wordpress.org/plugins/sina-extension-for-elementor/ (estimated URL; verify official source) workaround: WordPress Admin > Users > Edit roles/capabilities mitigation: Configure web server (Apache/Nginx) or WordPress security plugin (Wordfence, Sucuri) to enforce CSP and WAF rules detection: Use WordPress security scanner plugin or manual database review