EUVD-2025-17285

This vulnerability stems from improper input neutralization during web page generation (CWE-79: Improper Neutralization of Input During Web Page Generation). The Sina Extension for Elementor is a WordPress plugin that extends the Elementor page builder with additional functionality. The vulnerability likely exists in custom widgets or output functions where user-controlled input (possibly from element settings, custom fields, or shortcode parameters) is rendered directly into page HTML without adequate sanitization or escaping. The affected component processes data during the page rendering pipeline without properly neutralizing special characters or HTML entities, allowing XSS payload injection. This is a Stored XSS variant, meaning the malicious payload persists in the database and executes for all users viewing the affected page, rather than requiring a crafted URL.