Vulnerability record/PUBLISHED/Published Oct 25, 2026 06:00:21 UTC
CVE-2026-115183
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedOct 25, 2026 06:00:21 UTC
PublishedOct 25, 2026 06:00:21 UTC
ReservedOct 22, 2026 04:36:16 UTC
Credits
- Karthik Ramakrishnan
- WPScan