The Sina Extension for Elementor WordPress plugin before version 3.10.4 improperly escapes data in a Table widget setting, leading to a stored XSS vulnerability (CWE-79). This vulnerability permits users with Contributor role or above to inject malicious JavaScript code that is stored and rendered in HTML attributes, potentially compromising other users who view the affected content. The vulnerability is identified as CVE-2026-83541 and affects version 3.7.1 explicitly. No CVSS score or official remediation level is provided, and no patch links are currently available.

Successful exploitation could allow attackers with Contributor or higher privileges to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, defacement, or other malicious actions within the affected WordPress site. The impact is limited to users with at least Contributor role privileges being able to inject the payload, but the consequences affect other users viewing the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor and higher roles from accessing the vulnerable widget settings or disable the Sina Extension for Elementor plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.