CVE-2026-115183: Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

Q: Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can exploit it. The affected plugin is Qi Addons For Elementor before version 1.11.2.

Q: What does an attacker need to do to exploit it?

The attacker needs access to create or edit content using the Animated Text widget and must be able to supply crafted heading text containing HTML entities. After entity decoding, the unsanitized content can become live HTML in a post.

Q: What is the practical impact?

An attacker can embed live HTML forms, including password fields that submit data to an external host, in posts. This can enable phishing or credential collection from visitors who interact with the injected form.

Q: How can I tell whether content may already be affected?

Review posts created or edited by Contributor-level users for Animated Text widgets with suspicious heading text, especially entity-encoded HTML. Check rendered pages for unexpected forms or password input fields that submit to external hosts.

Published Oct 25, 2026

Updated

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

Affected Software

1 affected component

QODE Interactive Qi Addons For Elementor<1.11.2

Event History

Oct 25, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress Contributor role or any higher-privileged role can exploit it. The affected plugin is Qi Addons For Elementor before version 1.11.2.

What does an attacker need to do to exploit it?

The attacker needs access to create or edit content using the Animated Text widget and must be able to supply crafted heading text containing HTML entities. After entity decoding, the unsanitized content can become live HTML in a post.

What is the practical impact?

An attacker can embed live HTML forms, including password fields that submit data to an external host, in posts. This can enable phishing or credential collection from visitors who interact with the injected form.

How can I tell whether content may already be affected?

Review posts created or edited by Contributor-level users for Animated Text widgets with suspicious heading text, especially entity-encoded HTML. Check rendered pages for unexpected forms or password input fields that submit to external hosts.

CVE-2026-115183: Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to exploit it?

What is the practical impact?

How can I tell whether content may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to exploit it?

What is the practical impact?

How can I tell whether content may already be affected?