Threats tagged 'ghsa-q3pm-872x-6qfr'

The Qi Addons For Elementor WordPress plugin before version 1.11.2 contains a vulnerability where it does not properly sanitize a widget's heading text after decoding HTML entities. This flaw allows users with Contributor role or higher to embed live HTML forms, including password fields that submit data to external hosts, into posts where WordPress normally strips such content.