CVE-2026-115183
Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
- State
- Published
- Severity
- 2.4 Low
- Published
- Oct 25, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 22, 2026
Description
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.4 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
Qi Addons For ElementorUnknown |
|
References
- https://wpscan.com/vulnerability/a9cd8675-25f3-4d81-b768-4f20ef9208a8/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.