What is the CVSS score of CVE-2026-83541?

CVE-2026-83541 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-83541?

Yes, a public proof-of-concept exploit is available for CVE-2026-83541. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-83541?

Yes, a patch is available for CVE-2026-83541. Update the affected software to the latest version immediately.

Sina Extension Elementor CVE-2026-83541

EUVD-2026-74713 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-09 WPScan

GHSA-x3cw-pxr4-h4px

WordPress XSS Sina Extension For Elementor

6.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Contributor is a low-privilege WordPress role (PR:L); stored XSS executes in victim browser, crossing trust boundary (S:C); no direct server-side confidentiality, integrity, or availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 16:35 vuln.today

Patch available

Sep 09, 2026 - 07:03 EUVD

CVE Published

Sep 09, 2026 - 06:00 cve.org

MEDIUM 6.8

CVE Published

Sep 09, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

AnalysisAI

Stored cross-site scripting in the Sina Extension for Elementor WordPress plugin (versions before 3.10.4) allows authenticated users holding at least a Contributor role to inject persistent malicious scripts via an unescaped Table widget setting that is rendered inside an HTML attribute. When a higher-privileged user - such as an Editor or Administrator - views the affected page, the attacker-controlled script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an active, authenticated WordPress account at the Contributor role level or higher on the target installation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) is internally inconsistent with the described vulnerability in two ways: the Contributor role in WordPress is a low-privilege role (PR:L is the appropriate metric, not PR:H which implies administrator-level access), and stored XSS canonically produces a Scope:Changed (S:C) result because script execution occurs in a different user's browser context rather than the server (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Sina Extension for Elementor plugin to version 3.10.4 or later, where the Table widget setting is properly escaped before insertion into HTML attribute context. … Detailed patch versions, workarounds, and compensating controls in full report.