WordPress Plugin Vulnerabilities

Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

Description

The plugin does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

Proof of Concept

Affects Plugins

Plugin icon
qi-addons-for-elementor
Fixed in 1.11.2

References

CVE
CVE-2026-115183

Classification

Type
CONTENT INJECTION
OWASP top 10
A1: Injection
CWE
CWE-345
CVSS
2.4 (low)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
a9cd8675-25f3-4d81-b768-4f20ef9208a8

Timeline

Publicly Published
2026-10-23 (about 2 days ago)
Added
2026-10-23 (about 1 day ago)
Last Updated
2026-10-23 (about 1 day ago)

Other

Published
Title
Published
2024-03-08
Title
EventPrime – Events Calendar, Bookings and Tickets < 3.4.3 - Unauthenticated Booking Payment Bypass
Published
2026-09-21
Title
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
Published
2026-09-14
Title
Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
Published
2026-02-21
Title
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce < 6.4.8 - Unauthenticated Email Relay
Published
2024-06-03
Title
Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass