CVE-2026-115183

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

CVE-2026-115183 Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

CVE-2026-115183

The Qi Addons For Elementor WordPress plugin (versions before 1.11.2 ) is vulnerable to a content injection flaw. The root cause is the failure to properly sanitise a widget's heading text after decoding HTML entities. This allows users with the Contributor role or higher to embed live HTML forms...

EUVD-2026-109351

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts wher...

WordPress Qi Addons For Elementor plugin < 1.11.2 - Contributor+ Content Injection vulnerability

Contributor+ Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Qi Addons For Elementor versions 1.11.2...

CVE-2026-62079

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

CVE-2026-62079 WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

CVE-2026-62079 WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

EUVD-2026-89818

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

CVE-2026-62079

The Qi Addons For Elementor WordPress plugin, affecting versions

WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Qi Addons For Elementor versions = 1.11...

CVE-2026-62079: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

PT-2026-103150

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

WordPress Qi Addons For Elementor plugin <= 1.11 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Qi Addons For Elementor versions = 1.11...

CVE-2026-92249

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

EUVD-2026-82762

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2026-92249

Qi Addons For Elementor (WordPress plugin) versions up to and including 1.11 are vulnerable to Reflected DOM-Based Cross-Site Scripting via the s search parameter, caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute ...

CVE-2026-92249 Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2026-92249 Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

PT-2026-95299

Name of the Vulnerable Software and Affected Versions Qi Addons For Elementor versions prior to 1.12 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when the Table of Contents widget is placed o...