Live › vulnerability › CVE-2026-115183
Go to dashboardThe Qi Addons For Elementor WordPress plugin fails to sanitise widget heading text after decoding HTML entities, so the stored heading keeps markup WordPress would normally strip. A contributor-level user can embed live HTML forms, including password fields that post to an external host, which enables phishing of site visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the Qi Addons For Elementor plugin before 1.11.2 where users with the Contributor role or above can create or edit posts with Elementor heading widgets. Sites without the plugin, or where only trusted editors can write content, face less risk. The sources do not say whether the flaw depends on specific widget settings.
No product ranges from the sources yet.
wp plugin get qi-addons-for-elementor --field=version (version unknown in sources for the exact slug)<form> or <input type="password"> markup1.11.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
This page as .md · .json · in your agent: get_signal("CVE-2026-115183")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.