What is the CVSS score of CVE-2026-14190?

CVE-2026-14190 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14190?

Yes, a public proof-of-concept exploit is available for CVE-2026-14190. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14190?

Yes, a patch is available for CVE-2026-14190. Update the affected software to the latest version immediately.

Sina Extension CVE-2026-14190

EUVD-2026-49077 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-27 WPScan

GHSA-j952-f3p9-h3jg

WordPress XSS Sina Extension For Elementor Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

AV:N network, AC:L no special conditions, PR:N unauthenticated, UI:R required, S:C scope changed, C:L I:L low impact

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 16:27 vuln.today

CVSS changed

Jul 27, 2026 - 16:22 NVD

6.1 (MEDIUM)

Patch available

Jul 27, 2026 - 07:01 EUVD

CVE Published

Jul 27, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 06:00 cve.org

MEDIUM 6.1

DescriptionCVE.org

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.

AnalysisAI

Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. Public exploit code is available, and the vendor has released a patch in version 3.10.2.

Technical ContextAI

This is a stored/reflected XSS vulnerability (CWE-79) in the Sina Extension for Elementor, a WordPress plugin that extends the Elementor page builder. The affected AJAX handler is exposed to unauthenticated users and reconstructs a value from request input without proper escaping before including it in the HTML response. The CPE indicates all versions prior to 3.10.2 are vulnerable. The root cause is failure to sanitize user-supplied data in an AJAX response, allowing injection of arbitrary HTML and JavaScript.

RemediationAI

Update the Sina Extension for Elementor plugin to version 3.10.2 or later, which patches the unescaped output in the AJAX handler. This fix is available from the WordPress plugin repository or vendor directly. No workarounds are documented; however, as a temporary measure until upgrading, administrators can disable the plugin or restrict access to its AJAX endpoints via a web application firewall (WAF) rule. Disabling the plugin may affect site functionality that relies on the extension.