---
id: "CVE-2026-115183"
kind: "vulnerability"
aliases: ["CVE-2026-115183"]
title: "Qi Addons For Elementor: contributors can inject phishing forms into posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-at-1.11.2-or-later"]
published_at: "2026-10-25T06:16:32+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115183", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# Qi Addons For Elementor: contributors can inject phishing forms into posts

The Qi Addons For Elementor WordPress plugin fails to sanitise widget heading text after decoding HTML entities, so the stored heading keeps markup WordPress would normally strip. A contributor-level user can embed live HTML forms, including password fields that post to an external host, which enables phishing of site visitors.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or `wp plugin get qi-addons-for-elementor --field=version` (version unknown in sources for the exact slug)
- Review Elementor pages that use Qi Addons heading widgets for injected `<form>` or `<input type="password">` markup

## Fix

- Update the Qi Addons For Elementor plugin to `1.11.2` or later

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115183

## From the sources

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_