CVE-2026-115183 in Qi Addons for Elementor Plugin
Summary
by MITRE • 10/25/2026
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/25/2026
The Qi Addons For Elementor plugin for WordPress contains a critical input validation flaw within its widget rendering logic prior to version 1.11.2. The vulnerability stems from improper sanitization of user-supplied data specifically related to heading text fields. When the plugin processes this input, it performs HTML entity decoding but fails to subsequently apply rigorous output encoding or strict allow-listing against dangerous HTML tags and attributes. This sequence error creates a window where maliciously crafted content can bypass WordPress's default security mechanisms designed to strip potentially harmful code from post content.
This technical deficiency allows attackers with the Contributor role or higher privileges, such as Authors and Editors, to inject live HTML forms into website posts. Unlike standard text inputs that are typically sanitized by WordPress core functions like wp_kses_post, this specific vector permits the inclusion of form elements that can submit data directly to an external server controlled by the attacker. The ability to embed password fields within these injected forms significantly escalates the severity of the issue, as it facilitates direct credential harvesting from unsuspecting site visitors who interact with the compromised content.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Cross-Site Scripting (XSS) via improper input sanitization, and more specifically reflects aspects of CWE-830 regarding inclusion of functionality from an incorrect source due to weak validation. In terms of the MITRE ATT&CK framework for enterprise security, this flaw supports techniques associated with T1566.002, which covers Phishing: Spearphishing Attachment or Link variants where malicious content is embedded within legitimate-looking web pages. The attacker leverages their existing access level to plant these traps, effectively turning the website into a phishing infrastructure without needing full administrative control over the WordPress installation itself.
The operational impact of this vulnerability extends beyond simple defacement or session hijacking. By embedding forms that submit credentials to external hosts, attackers can conduct large-scale credential stuffing attacks against users who trust the compromised site. This undermines the integrity and confidentiality guarantees provided by the web application. Furthermore, because the attack requires only Contributor-level access, it is relatively easy for a malicious insider or an account compromised through weak authentication practices to exploit this flaw without triggering immediate alarms associated with high-privilege changes.
To mitigate this risk, administrators must upgrade the Qi Addons For Elementor plugin to version 1.11.2 or later immediately upon availability. This update addresses the sanitization logic by ensuring that heading text is properly escaped after any decoding operations occur, thereby preventing the injection of executable HTML structures like forms and password fields. In environments where immediate patching is not feasible due to compatibility concerns, implementing a Web Application Firewall with rules targeting form tag injections in post content can provide temporary protection. Additionally, enforcing strict role-based access control policies ensures that only trusted users have Contributor-level or higher privileges, reducing the attack surface available for this specific exploitation path.