Qi Addons For Elementor

Qi Addons for Elementor decodes HTML entities in widget heading text without adequately sanitizing the decoded result. A Contributor or higher can supply heading text that becomes live HTML forms in posts, including password inputs that submit to an external host, bypassing markup restrictions WordPress would otherwise apply. This supports credential-harvesting content; arbitrary JavaScript execution is not established by this description. The exact widget identifier, heading parameter and processing function are not disclosed in the export. Published affected versions: < 1.11.2.

Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions. The reported impact is browser script execution in the affected site's origin. The injected field, rendering context and exact victim interaction are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 1.11.1.

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter. Exposure depends on the widget scanning search-result headings outside the main content area; the complete request-to-widget route is not disclosed. Affected versions reported by the CNA: <= 1.11. Official changelog review confirms 1.11.1 as a fixed release for this issue.

Qi Addons For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Qi Addons For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Qi Addons For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Qi Addons For Elementor is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.

Qi Addons For Elementor is affected by filesystem traversal. Exploitation requires an authenticated contributor account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Qi Addons For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Qi Addons For Elementor is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Qi Addons For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Qi Addons For Elementor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Qi Addons For Elementor is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.