The vulnerability is a contributor‑level Cross‑Site Scripting flaw in the Qi Addons For Elementor plugin for WordPress. An attacker who can submit content as a contributor can inject arbitrary HTML or JavaScript that is rendered in the page for all visitors. This can lead to theft of cookies, session hijacking, phishing, or defacement of the site, compromising confidentiality and integrity of the site’s data.

The issue affects WordPress sites that install the Qi Addons For Elementor plugin version 1.11 or earlier, provided a contributor user role exists. Sites running a newer version (1.11.1 or later) are not impacted.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable through normal content submission by a contributor, so the attack vector is likely local on the site, requiring that the attacker has at least contributor privileges. Once injected, the script runs in the context of site visitors, giving the attacker the ability to perform client‑side attacks.