CVE-2025-49262 describes a Stored Cross-site Scripting (XSS) vulnerability in the shaonsina Sina Extension for Elementor plugin for WordPress, affecting versions up to 3.6.1. This vulnerability is due to improper neutralization of input during web page generation, which allows an attacker with high privileges to inject malicious scripts that are stored and later executed in the browsers of users who view the affected content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No patch or official remediation details are currently provided.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject persistent malicious scripts into web pages generated by the plugin. This can lead to unauthorized disclosure of sensitive information (confidentiality impact is high) and limited denial of service (availability impact is low). Integrity impact is not indicated. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict high privilege access to trusted administrators only and monitor for suspicious activity related to the plugin. Avoid using affected versions of the plugin if possible, or disable the plugin until a patch is released.