{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1517", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-20T20:04:12.778Z", "datePublished": "2025-02-26T08:21:56.971Z", "dateUpdated": "2026-04-08T17:30:13.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:13.497Z"}, "affected": [{"vendor": "shaonsina", "product": "Sina Extension for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Sina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e699f521-9133-41b0-b667-528da78fec06?source=cve"}, {"url": "https://wordpress.org/plugins/sina-extension-for-elementor/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/basic/sina-fancytext.php"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-countdown.php"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-login-form.php"}, {"url": "https://github.com/shaonsina/sina-extension-for-elementor/commit/5cb89db08b15a3011800ee0f6ad68c69c5a256d5"}, {"url": "https://plugins.trac.wordpress.org/changeset/3246221/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-02-25T19:36:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-26T14:46:46.108915Z", "id": "CVE-2025-1517", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T15:32:27.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1517", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-26T14:46:46.108915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T14:46:47.331Z"}}], "cna": {"title": "Sina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "shaonsina", "product": "Sina Extension for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-25T19:36:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e699f521-9133-41b0-b667-528da78fec06?source=cve"}, {"url": "https://wordpress.org/plugins/sina-extension-for-elementor/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/basic/sina-fancytext.php"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-countdown.php"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-login-form.php"}, {"url": "https://github.com/shaonsina/sina-extension-for-elementor/commit/5cb89db08b15a3011800ee0f6ad68c69c5a256d5"}, {"url": "https://plugins.trac.wordpress.org/changeset/3246221/"}], "descriptions": [{"lang": "en", "value": "The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:13.497Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1517", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:13.497Z", "dateReserved": "2025-02-20T20:04:12.778Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-26T08:21:56.971Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sinaextra:sina_extension_for_elementor:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "31A5A598-7E78-4D77-A7AF-36C533D630E5", "versionEndExcluding": "3.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets &amp; Elementor Templates) para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s de los c\u00f3digos cortos Fancy Text, Countdown Widget y Login Form del complemento en todas las versiones hasta la 3.6.0 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-1517", "lastModified": "2025-03-24T17:56:06.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-26T13:15:41.193", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://github.com/shaonsina/sina-extension-for-elementor/commit/5cb89db08b15a3011800ee0f6ad68c69c5a256d5"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-countdown.php"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-login-form.php"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/basic/sina-fancytext.php"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3246221/"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/sina-extension-for-elementor/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e699f521-9133-41b0-b667-528da78fec06?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:47:45.673944+00:00", "value": {"mitigation_remediation": ["Upgrade the Sina Extension for Elementor plugin to the latest version that includes the fix (any release newer than 3.6.0).", "If an upgrade cannot be performed immediately, disable the Fancy Text, Countdown Widget, and Login Form shortcodes for users with contributor-level or lower roles to prevent injection of malicious scripts.", "Monitor site traffic and logs for anomalous script activity and consider implementing WAF rules to block suspicious JavaScript payloads."], "summary": {"action": "Patch Now", "impact": "Stored cross-site scripting that allows authenticated users to inject scripts"}, "threat_synthesis": {"affected_systems": "The affected product is the Sina Extension for Elementor plugin by shaonsina, available for WordPress. All releases up to and including version 3.6.0 are affected.", "description_and_impact": "The Sina Extension for Elementor plugin for WordPress is vulnerable to a stored cross-site scripting flaw caused by insufficient input sanitization and output escaping on user-supplied attributes in its Fancy Text, Countdown Widget, and Login Form shortcodes. This flaw lets an authenticated attacker with contributor-level or higher access inject arbitrary JavaScript into the plugin\u2019s shortcode attributes, which is then stored in the database and executed in the context of any user who later visits an affected page. The resulting injection can compromise confidentiality and integrity by draining credentials, hijacking sessions, or maligning user sessions.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity vulnerability, while the EPSS score of less than 1\u00a0% suggests that exploitation is unlikely. The flaw is not listed in CISA KEV, implying that it is not a known, exploited vulnerability at the time of this analysis. Because the attack requires authenticated contributor-level access, the vector is limited to users who have already been granted writing privileges to the site or whose credentials have been compromised. Once an attacker injects malicious code through the vulnerable shortcodes, any subsequent visitor to the affected page will execute the script in their browser."}}}}, "created": "2026-04-21T00:00:13.355128+00:00", "updated": "2026-04-21T00:00:13.355147+00:00", "vendors": []}