The Qi Addons For Elementor plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) in all versions up to and including 1.11. The vulnerability arises due to insufficient sanitization and output escaping of the 's' parameter in the search results page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page with the 'Limit ToC to Main Page Content' option disabled, allowing the widget to scan and reflect the unsanitized 's' parameter in the page heading. This enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected page.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users visiting the affected pages, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or conduct other malicious activities. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity with limited impact on availability. The CVSS 3.1 base score is 6.1 (medium severity).

No official patch or fix is currently documented. Users should consider disabling the Table of Contents widget on templates that render search results or enable the 'Limit ToC to Main Page Content' option to prevent the widget from scanning the unsanitized 's' parameter. Monitor vendor advisories for updates or patches addressing this vulnerability.