CVE-2026-115183

LowCVSS 2.4/10Last modified Oct 26, 2026

Description

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

VendorProductVersions
UnknownQi Addons For Elementor< 1.11.2

References

Timeline

Published
Oct 25, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1151889.9An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, tCVE-2026-1151898.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict userCVE-2026-115196.3A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of thCVE-2026-1151908.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.CVE-2026-1151917.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameterCVE-2026-1151927.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the CVE-2026-1151938.2A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields aCVE-2026-1151946.5A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not reCVE-2026-1151956.5A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for seveCVE-2026-1151965.4An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the applicCVE-2026-11529.8A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the componentCVE-2026-115203.5A weakness has been identified in SourceCodester Inventory System 1.0. Affected by this issue is some unknown functionality of the file head
CVE-2026-115183: Low severity, CVSS 2.4 | Vulnix