Vulnerability · Published Oct 25, 2026 · Assigned by WPScan

CVE-2026-115183Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

Low 2.4

In plain English

A low-severity insufficient verification of data authenticity in Qi Addons For Elementor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)<0.1%top 99.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Qi Addons For Elementor	0 – before 1.11.2

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/a9cd8675-25f3-4d81-b768-4f20ef9208a8/ exploit, vdb-entry, technical-description