CVE-2026-115183 Qi Addons For Elementor CVE debrief

Who should care

Defenders responsible for WordPress installations using the Qi Addons For Elementor plugin should assess exposure and verify the plugin version. They should also review compensating controls for exposed systems and monitor for suspicious activity on WordPress posts. Additionally, they should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

The Qi Addons For Elementor WordPress plugin vulnerability allows users to embed live HTML forms, including password fields, into posts, potentially leading to phishing attacks and data exfiltration.

• Potential for phishing attacks via embedded password fields
• Possible data exfiltration through external host submissions
• Risk of unauthorized access to sensitive information
• Need for verification of plugin version and remediation

Technical summary

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them. This vulnerability can lead to potential phishing attacks and data exfiltration. The vulnerability is caused by inadequate sanitization of user input, allowing malicious users to inject HTML code.

Defensive priority

Defenders should prioritize verifying the version of the Qi Addons For Elementor WordPress plugin and ensuring it is updated to 1.11.2 or later, as the vulnerability allows users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host.

Recommended defensive actions

• Verify the version of the Qi Addons For Elementor WordPress plugin and update to 1.11.2 or later
• Restrict the Contributor role and above to prevent embedding live HTML forms
• Monitor for suspicious activity on WordPress posts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan. The vulnerability allows users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts. The source details are limited, and defenders should verify the plugin version and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.