CVE-2026-115183: CWE-345 Insufficient Verification of Data Authenticity in Qi Addons For Elementor
Affects Qi Addons For ElementorSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Qi Addons For Elementor | Affected
| Fixed in
|
AI-suggested
Upgrade the Qi Addons For Elementor plugin to version 1.11.2 or later, where this vulnerability is fixed. No other specific mitigations are indicated. Patch status is not explicitly confirmed in the input data, but the version range indicates the issue is resolved starting from 1.11.2.
Description
The Qi Addons For Elementor WordPress plugin before version 1.11.2 contains a vulnerability where it does not properly sanitize a widget's heading text after decoding HTML entities. This flaw allows users with Contributor role or higher to embed live HTML forms, including password fields that submit data to external hosts, into posts where WordPress normally strips such content.
Impact
Users with Contributor role or higher can embed malicious HTML forms into posts, potentially tricking site visitors into submitting sensitive information such as passwords to external servers. This undermines data authenticity verification and could lead to data leakage or phishing attacks within the affected WordPress site.
Weaknesses
- CWE-345Insufficient Verification of Data Authenticity (opens in a new tab)
Class weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.