Qi Addons for Elementor: Contributor HTML-form injection in heading text
Qi Addons for Elementor decodes HTML entities in widget heading text without adequately sanitizing the decoded result. A Contributor or higher can supply heading text that becomes live HTML forms in posts, including password inputs that submit to an external host, bypassing markup restrictions WordPress would otherwise apply. This supports credential-harvesting content; arbitrary JavaScript execution is not established by this description. The exact widget identifier, heading parameter and processing function are not disclosed in the export. Published affected versions: < 1.11.2.
- Component
- Qi Addons For Elementor
- Plugin slug
qi-addons-for-elementor- Affected
- < 1.11.2
- Safe version
1.11.2- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 13 known issues for this plugin.
Update, patch or deactivate.
Update Qi Addons For Elementor to 1.11.2 or later. Sanitize the fully decoded heading value against its allowed markup and escape it for the output context. Remove unexpected forms or external submission destinations from existing content and review any credentials submitted to them.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.