◆ CVE Hub

CVE-2026-115183

Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

Published
2026-10-25
Last modified
2026-10-25
CNA
WPScan
NVD status
Received
CWE
CWE-345
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed

Description

NVD

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownQi Addons For Elementor
affected: 0 … < 1.11.2
default: unaffected

Linux distribution status

Red Hat ↗

Not tracked by this distribution.

Debian ↗

No record

Ubuntu ↗

Not tracked by this distribution.

References (1)