CVE-2024-5036

The Sina Extension for Elementor plugin for WordPress contains a stored cross-site scripting vulnerability in versions 3.5.4 and earlier, stemming from inadequate sanitization and escaping of the 'url' parameter. Authenticated users with Contributor-level permissions or higher can inject malicious scripts that persist in pages and execute when other users view the affected content. The vulnerability affects multiple widgets including sliders, galleries, forms, modals, data tables, and tabs. Upgrading to version 3.5.5 or later resolves this security issue.

Based on public CVE data (MITRE/NVD).