Unrated severityNVD Advisory· Published Oct 25, 2026

CVE-2026-115183

Description

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Qi Addons For Elementorllm-fuzzy
Range: <1.11.2
Package: https://wordpress.org/plugins/qi-addons-for-elementor

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/a9cd8675-25f3-4d81-b768-4f20ef9208a8/nvd

News mentions

WordPress Plugins: 25 Vulnerabilities Disclosed in Batch, Including Critical Flaws
Vypr Intelligence · Oct 25, 2026

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000