CVE-2026-14190

Name of the Vulnerable Software and Affected Versions Sina Extension for Elementor versions prior to 3.10.2

Description An unauthenticated AJAX handler fails to escape a value reconstructed from request input before reflecting it into the HTML response. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of users who trigger a crafted request, leading to a Reflected Cross-Site Scripting (XSS) attack. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Update Sina Extension for Elementor to version 3.10.2 or later.