CVE-2026-83541— Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget
Quick assessment
Affected
Unknown Sina Extension for Elementor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sina Extension for Elementor WordPress 插件在 3.10.4 版本之前未对 Table 组件的配置项进行充分转义，即将其作为 HTML 属性输出时存在转义不当的问题，这可能允许拥有“贡献者”（Contributor）角色或更高权限的用户执行存储型跨站脚本攻击（Stored Cross-Site Scripting, XSS）。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Sina Extension for Elementor | 3.7.1< 3.10.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-83541
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget
Source: CVE Program / CVE List V5
Vulnerability Description
The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Sina Extension for Elementor | 3.7.1 ~ 3.10.4 | - |
|
II. Public POCs for CVE-2026-83541
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-83541
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-83541 (1)
-
🔗 Sina Extension for Elementor 3.7.1 – 3.10.3 – Contributor+ Stored XSS via Table Widget | CVE 2026-83541 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-09 · 28 CVEs total
| CVE-2026-19855 | 6.5 MEDIUM | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Short |
| CVE-2026-85117 | 6.5 MEDIUM | Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via F |
| CVE-2026-83537 | 5.3 MEDIUM | WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymen |
| CVE-2026-80440 | 4.8 MEDIUM | Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Plac |
| CVE-2025-15690 | Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles | |
| CVE-2026-13144 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset | |
| CVE-2026-13146 | WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR | |
| CVE-2026-14962 | ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id | |
| CVE-2026-18042 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-16960 | Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure | |
| CVE-2026-75861 | Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction | |
| CVE-2026-80339 | Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80340 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80341 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assign | |
| CVE-2026-81021 | SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure | |
| CVE-2026-81741 | Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter | |
| CVE-2026-81022 | SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak | |
| CVE-2026-82185 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Rese | |
| CVE-2026-82848 | Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure | |
| CVE-2026-82184 | WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Sina Extension for Elementor
-
CVE-2026-14190
Sina Extension for Elementor < 3.10.2 - Reflected XSS -
CVE-2025-6229
Sina Extension for Elementor (Slider, Gallery, Form, Modal, -
CVE-2025-6228
Sina Extension for Elementor <= 3.7.0 - Authenticated (Contr -
CVE-2025-49262
WordPress Sina Extension for Elementor plugin <= 3.6.1 - Cro -
CVE-2025-1517
Sina Extension for Elementor <= 3.6.0 - Authenticated (Contr
Same vendor: Unknown
-
CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via ' -
CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle C -
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscrib -
CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclos -
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sor
V. Comments for CVE-2026-83541
No comments yet