CVE-2025-6229

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6229", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-18T12:39:37.411Z", "datePublished": "2026-03-23T06:41:07.423Z", "dateUpdated": "2026-04-08T17:01:57.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:57.048Z"}, "affected": [{"vendor": "shaonsina", "product": "Sina Extension for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Fancy Text Widget` And `Countdown Widget` DOM attributes in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/78b444a2-e5d7-4c3a-86a4-c215c54687a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/assets/js/sina-widgets.js"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-06-10T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-22T18:10:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T13:55:37.850207Z", "id": "CVE-2025-6229", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T13:55:46.405Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6229", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T13:55:37.850207Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T13:55:42.678Z"}}], "cna": {"title": "Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "shaonsina", "product": "Sina Extension for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-10T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-03-22T18:10:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/78b444a2-e5d7-4c3a-86a4-c215c54687a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/assets/js/sina-widgets.js"}], "descriptions": [{"lang": "en", "value": "The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Fancy Text Widget` And `Countdown Widget` DOM attributes in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:57.048Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6229", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:57.048Z", "dateReserved": "2025-06-18T12:39:37.411Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-23T06:41:07.423Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Sina Extension for Elementor", "vendor": "shaonsina", "versions": [{"lessThanOrEqual": "3.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Fancy Text Widget` And `Countdown Widget` DOM attributes in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "La extensi\u00f3n Sina para Elementor (Header Builder, Footer Builder, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets &amp; Elementor Templates) plugin para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los atributos DOM 'Fancy Text Widget' y 'Countdown Widget' en todas las versiones hasta la 3.7.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-6229", "lastModified": "2026-06-17T10:01:25.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6229", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T13:55:37.850207Z", "version": "2.0.3"}}]}, "published": "2026-03-23T07:16:05.237", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/assets/js/sina-widgets.js"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/78b444a2-e5d7-4c3a-86a4-c215c54687a2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.0]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Sina Extension for Elementor", "source": "cna", "vendor": "shaonsina"}, "product": "sina_extension_for_elementor", "vendor": "shaosina"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-23T07:21:09.870092+00:00", "value": {"mitigation_remediation": ["Install the latest version of Sina Extension for Elementor that is newer than 3.7.0.", "If a newer version is unavailable, delete or disable the Fancy Text Widget and Countdown Widget from existing pages.", "Restrict Contributor access to only trusted users and audit contributor privileges.", "Remove any known injected scripts from existing pages or widgets.", "Verify that no remaining widget content contains malicious code and monitor user activity for anomalous behaviors."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Sina Extension for Elementor plugin and are running any version up to and including 3.7.0 are affected. Sites that use the Fancy Text Widget or Countdown Widget in page content are at risk, regardless of the overall site's user base size.", "description_and_impact": "The flaw originates from the SHAONSINA Sina Extension for Elementor plugin, where the Fancy Text Widget and Countdown Widget fail to sanitize and escape user input. An attacker who can authenticate with a Contributor role or higher can inject arbitrary JavaScript that will run in the browser of any visitor who opens a page containing the malicious widget. This capability can be used to steal session cookies, deface the site, redirect users, or perform other malicious actions in the victim\u2019s context. The vulnerability falls under the Common Weakness Enumeration CWE\u201179, which focuses on unsanitized input leading to cross\u2011site scripting attacks.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity. Because the exploit requires authentication with at least Contributor privileges, the risk of a wide\u2011scale public exploitation is reduced, yet sites with many contributors remain vulnerable. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to log into the WordPress backend, create or edit a page containing the vulnerable widget, insert malicious script, and then wait for any site visitor to trigger execution. The dependence on authenticated access limits, but does not eliminate, the potential for abuse."}}}}, "created": "2026-03-23T09:45:15.743884+00:00", "updated": "2026-03-25T14:49:36.120254+00:00", "vendors": ["shaosina", "shaosina$PRODUCT$sina_extension_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}