{"id":"CVE-2026-115183","kind":"vulnerability","aliases":["CVE-2026-115183"],"related":[],"title":"Qi Addons For Elementor: contributors can inject phishing forms into posts","description":"The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.","summary":"The Qi Addons For Elementor WordPress plugin fails to sanitise widget heading text after decoding HTML entities, so the stored heading keeps markup WordPress would normally strip. A contributor-level user can embed live HTML forms, including password fields that post to an external host, which enables phishing of site visitors.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-at-1.11.2-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get qi-addons-for-elementor --field=version` (version unknown in sources for the exact slug)\n- Review Elementor pages that use Qi Addons heading widgets for injected `<form>` or `<input type=\"password\">` markup","fix":"- Update the Qi Addons For Elementor plugin to `1.11.2` or later","status":"open","published_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:36+00:00","updated_at":"2026-10-25T06:37:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T06:37:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Qi Addons For Elementor plugin to `1.11.2` or later","reach":"internet","title":"Qi Addons For Elementor: contributors can inject phishing forms into posts","impact":"medium","summary":"The Qi Addons For Elementor WordPress plugin fails to sanitise widget heading text after decoding HTML entities, so the stored heading keeps markup WordPress would normally strip. A contributor-level user can embed live HTML forms, including password fields that post to an external host, which enables phishing of site visitors.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Phishing forms with password fields are served from the site to visitors","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get qi-addons-for-elementor --field=version` (version unknown in sources for the exact slug)\n- Review Elementor pages that use Qi Addons heading widgets for injected `<form>` or `<input type=\"password\">` markup","needs_analyst":false,"not_affected_if":["plugin-at-1.11.2-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Qi Addons For Elementor plugin before 1.11.2 where users with the Contributor role or above can create or edit posts with Elementor heading widgets. Sites without the plugin, or where only trusted editors can write content, face less risk. The sources do not say whether the flaw depends on specific widget settings.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3322,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115183':14A,17A '-2026':13A,16A '1.11.2':84C 'addon':2A,26B,78C 'allow':100C 'contributor':5A,53B,104C 'contributor-level':52B 'cve':12A,15A 'decod':38B,95C 'elementor':4A,18B,28B,80C 'emb':57B,109C 'enabl':71B 'entiti':40B,97C 'extern':68B,120C 'fail':31B 'field':63B,115C 'form':9A,60B,112C 'head':35B,44B,92C 'host':22B,69B,121C 'html':39B,59B,96C,111C 'includ':61B,113C 'inject':7A 'keep':45B 'level':54B 'live':58B,110C 'markup':46B 'normal':49B 'otherwis':127C 'packag':19B 'password':62B,114C 'phish':8A,72B 'plugin':30B,82C 'post':11A,65B,123C 'proper':87C 'qi':1A,25B,77C 'role':105C 'sanitis':33B,88C 'self':21B 'self-host':20B 'site':74B 'store':43B 'strip':50B,128C 'submit':117C 'text':36B,93C 'user':55B,101C 'visitor':75B 'widget':34B,90C 'wordpress':23B,29B,47B,81C,125C 'would':48B,126C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Qi Addons For Elementor plugin before 1.11.2 where users with the Contributor role or above can create or edit posts with Elementor heading widgets. Sites without the plugin, or where only trusted editors can write content, face less risk. The sources do not say whether the flaw depends on specific widget settings.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115183","severity":null,"published_at":"2026-10-25T06:16:32+00:00","modified_at":"2026-10-25T06:16:32+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}