CVE-2026-115183 — LOW (2.4)

Vulnerability Description

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.

CVSS Score

2.4

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-345

References

https://wpscan.com/vulnerability/a9cd8675-25f3-4d81-b768-4f20ef9208a8/

FAQ

What is CVE-2026-115183?

CVE-2026-115183 is a vulnerability with a CVSS score of 2.4 (LOW). The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to ...

How severe is CVE-2026-115183?

CVE-2026-115183 has been rated LOW with a CVSS base score of 2.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-115183?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.