Qi Addons CVE-2026-115183

Requires an authenticated account with the Contributor role or above on a WordPress site running Qi Addons For Elementor before 1.11.2, and requires that the attacker use the plugin's heading widget: HTML entities placed in the heading text are decoded AFTER WordPress's normal sanitisation, so markup WordPress would otherwise strip (including a password input whose form submits to an external host) renders as a live form. Exploitation is further limited because it is not self-executing - a victim (site administrator or visitor) must view the affected post and actively enter and submit credentials into the injected form for credential theft to occur. It only affects sites on vulnerable versions below 1.11.2.

All decision signals converge on LOW real-world priority. The vuln.today decision label is 'monitor', EPSS is 0.10% (1st percentile - effectively no measured exploitation pressure), and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. The input CVSS base score is only 2.4 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N): network vector but gated by high privilege requirement, required user interaction, and only Low integrity impact with no confidentiality or availability impact. A notable internal conflict exists between the metadata and the description: the supplied vector encodes PR:H (high privileges), yet the description states the flaw is reachable by 'users with the Contributor role and above' - Contributor is a LOW-privilege authenticated role, which argues for PR:L rather than PR:H. This discrepancy slightly understates ease of access while the overall severity remains low. The 'Information Disclosure' tag is also imprecise: the mechanism (CWE-345, insufficient verification of data authenticity) is stored content/phishing-form injection to harvest credentials from a victim, not a direct read of protected data. Net: this is a genuine but low-urgency stored-injection/phishing issue requiring an insider or compromised low-privilege account plus victim interaction - not an emergency.

A user with a Contributor (or higher) account on the WordPress site edits a post using the Qi Addons heading widget and places HTML-entity-encoded markup - including a password input field whose form action points to an attacker-controlled external host - into the heading text. Because the plugin decodes the entities after WordPress's normal sanitisation, the markup renders as a live form; a site administrator or visitor who views the post and enters credentials sends them to the external host. A public PoC reference exists (WPScan); it is not verified as working exploit code.