---
id: CVE-2026-115183
title: >-
  Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated
  Text Widget
summary: >-
  The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly
  sanitise a widget's heading text after decoding HTML entities in it, allowing
  users with the Contributor role and above to embed live HTML forms, including
  pass…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-345
product: Qi Addons For Elementor
affected:
  - qi_addons_for_elementor < 1.11.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T10:06:47.961325Z'
published: '2026-10-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T10:13:36.538Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115183'
references:
  - url: 'https://wpscan.com/vulnerability/a9cd8675-25f3-4d81-b768-4f20ef9208a8/'
tags:
  - cve.org
epss: 0.00095
epssPercentile: 0.00623
ingestedAt: '2026-10-25T22:08:29.962Z'
---

## Overview

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

## Affected

- `qi_addons_for_elementor < 1.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.