Stored Cross-Site Scripting in Sina Extension for Elementor by WordPress

CVE-2025-6228

What is CVE-2025-6228?

The Sina Extension for Elementor, which includes a variety of widgets such as Header Builder, Footer Builder, and others, has a vulnerability that allows for Stored Cross-Site Scripting (XSS). This issue arises from inadequate input sanitization and output escaping within the Sina Posts, Sina Blog Post and Sina Table widgets. Authenticated attackers with Contributor-level access and higher can exploit this vulnerability to inject arbitrary web scripts. These scripts execute in the context of unsuspecting users accessing affected pages, posing significant risks to security and user data.

References