Qi Addons For Elementor: Reflected XSS in search-result table of contents
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter. Exposure depends on the widget scanning search-result headings outside the main content area; the complete request-to-widget route is not disclosed. Affected versions reported by the CNA: <= 1.11. Official changelog review confirms 1.11.1 as a fixed release for this issue.
- Component
- Qi Addons For Elementor
- Plugin slug
qi-addons-for-elementor- Affected
- <= 1.11
- Safe version
1.11.1- Published
- Sep 18, 2026
This CVE was published Sep 18, 2026 and is one of 13 known issues for this plugin.
Update, patch or deactivate.
The official changelog confirms a fix in 1.11.1: Fixes reflected XSS in Table of Contents on search-result pages. Update to that release or a later supported version. Official changelog: https://wordpress.org/plugins/qi-addons-for-elementor/#developers Escape heading content and attribute output after constructing the table of contents. Remove this widget from search-result templates or enable the stated main-content restriction until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N