EUVD-2025-208932
GHSA-r3p6-6v6q-48jv
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Fancy Text Widget` And `Countdown Widget` DOM attributes in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Analysis
The Sina Extension for Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Fancy Text Widget and Countdown Widget that allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript into pages through insufficiently sanitized DOM attributes. When users visit pages containing the malicious widgets, the injected scripts execute in their browsers, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions on behalf of the victim. The vulnerability affects all versions up to and including 3.7.0, with a CVSS score of 6.4 indicating medium severity, though the impact is amplified by the stored nature of the XSS and the broad audience of WordPress sites using this popular page builder extension.
Technical Context
The Sina Extension for Elementor (CPE: cpe:2.3:a:shaonsina:sina_extension_for_elementor:*:*:*:*:*:*:*:*) is a WordPress plugin that extends the Elementor page builder with additional widgets including Fancy Text and Countdown functionality. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting). The root cause is insufficient input sanitization and output escaping in the widget's handling of DOM attributes, meaning user-supplied input is not properly validated before being inserted into the page DOM, and output is not properly escaped when rendered to HTML. The JavaScript file at plugins/sina-extension-for-elementor/tags/3.7.0/assets/js/sina-widgets.js contains the vulnerable widget initialization code that processes these attributes without adequate security controls.
Affected Products
The Sina Extension for Elementor plugin (CPE: cpe:2.3:a:shaonsina:sina_extension_for_elementor:*:*:*:*:*:*:*:*) is affected in all versions up to and including 3.7.0. This includes all prior releases from the plugin's inception through version 3.7.0. The vulnerability is specific to the Fancy Text Widget and Countdown Widget components within the plugin. Additional information and vulnerability tracking can be found at the Wordfence Threat Intelligence page: https://www.wordfence.com/threat-intel/vulnerabilities/id/78b444a2-e5d7-4c3a-86a4-c215c54687a2?source=cve, and the vulnerable code can be reviewed in the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/assets/js/sina-widgets.js.
Remediation
WordPress site administrators should immediately upgrade the Sina Extension for Elementor plugin to a version newer than 3.7.0 when available. Until a patched version is released, site administrators should restrict Contributor-level and above user access to only trusted individuals, disable or deactivate the plugin if not essential to site functionality, and audit all existing pages using the Fancy Text Widget and Countdown Widget for suspicious content or script injections. For sites that cannot immediately patch, implement WordPress security hardening measures including a Web Application Firewall (WAF) with XSS detection rules, regular security audits using tools like Wordfence or Sucuri, and enable logging and monitoring of widget content modifications. Monitor the official plugin repository and vendor advisories for patch releases, and test patches in a staging environment before deploying to production.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today