Technical impact
The Qi Addons For Elementor WordPress plugin fails to sanitize a widget’s heading text after HTML entities are decoded, which allows users with Contributor or higher roles to embed arbitrary HTML forms in post content. Those forms can submit sensitive fields such as passwords to external hosts, creating a vector for credential harvesting and phishing attacks. This flaw is a classic content injection vulnerability, enabling attackers to place live HTML that persists even when WordPress normally strips such input.
Affected Systems
This issue affects the Qi Addons For Elementor plugin for WordPress. Any installation running a version earlier than 1.11.2 is vulnerable, regardless of the site’s configuration, as the flaw resides in the core widget rendering logic.
Risk and Exploitability
The vulnerability does not rely on network or external trigger; it requires only that the actor hold Contributor‑level permissions to edit posts. Once such access is secured, injection is trivial and would be visible to all visitors of the impacted post. The CVSS score of 2.4 indicates low severity, and the EPSS score is <1%, indicating a very low probability of exploitation. Although the flaw is not listed in the CISA KEV catalog, the potential for credential harvesting makes patching a prudent step.
