Stored Cross-Site Scripting Flaw in Sina Extension for Elementor by WordPress
CVE-2024-3988

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Sina Extension For Elementor (slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Vendor
CVE Published:
25 April 2024

Summary

The Sina Extension for Elementor plugin, which includes various widgets and templates, contains a vulnerability where insufficient input sanitization allows authenticated users with contributor-level access or higher to exploit the Sina Fancy Text Widget. This flaw can lead to the injection of arbitrary web scripts into pages that execute whenever those pages are accessed by users, posing a significant risk to site integrity and user security.

Affected Version(s)

Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) * <= 3.5.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/sina-extension...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.