CVE-2026-92249: Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized s parameter.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
A site is exposed only when the Table of Contents widget is placed in a template rendered on WordPress search-results pages, such as a sitewide header or footer, and its “Limit ToC to Main Page Content” setting remains at the default value of No.
Does an attacker need an account or elevated privileges?
No. An unauthenticated attacker can craft a search request using the s parameter, but a user must access the resulting injected page for the script to execute.
How can I determine whether my site has the vulnerable configuration?
Review templates that appear on search-results pages for the Qi Addons Table of Contents widget. Check whether “Limit ToC to Main Page Content” is set to No and whether the widget can scan the search-results heading.
What can be done if updating is not immediately possible?
Remove the Table of Contents widget from templates rendered on search-results pages, or change “Limit ToC to Main Page Content” from its default setting of No so it does not scan the reflected search-results heading.