---
id: CVE-2026-115183
title: >-
  Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated
  Text Widget
summary: >-
  The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly
  sanitise a widget's heading text after decoding HTML entities in it, allowing
  users with the Contributor role and above to embed live HTML forms, including
  pass…
severity: none
cwe:
  - CWE-345
product: Qi Addons For Elementor
affected:
  - qi_addons_for_elementor < 1.11.2
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T06:00:21.850Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115183'
references:
  - url: 'https://wpscan.com/vulnerability/a9cd8675-25f3-4d81-b768-4f20ef9208a8/'
tags:
  - cve.org
epss: 0.00097
epssPercentile: 0.00725
ingestedAt: '2026-10-25T22:08:29.962Z'
---

## Overview

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

## Affected

- `qi_addons_for_elementor < 1.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.