EUVD-2026-82762
GHSA-3582-rw9h-cv52
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated reflected XSS (PR:N, UI:R) executing in the victim browser across a boundary (S:C) with limited confidentiality/integrity impact and no availability effect; the config gate is a real-world limiter, not a base-metric change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the 'Limit ToC to Main Page Content' option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized s parameter.
AnalysisAI
Reflected cross-site scripting (XSS) in the Qi Addons For Elementor plugin for WordPress (versions up to and including 1.11) allows unauthenticated remote attackers to inject arbitrary web scripts via the 's' search parameter, but exploitation is highly conditional: it requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., sitewide header or footer) with the 'Limit ToC to Main Page Content' option left at its default value of No, and it requires victim interaction (opening a crafted search URL). The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific site configuration: the Qi Addons Table of Contents widget must be placed on a template that renders on the WordPress search-results page (such as a sitewide header or footer template), AND the widget's 'Limit ToC to Main Page Content' option must be left at its default value of No, so it scans the search-results heading that reflects the attacker-controlled 's' parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a network-reachable, low-complexity, unauthenticated reflected XSS that requires victim interaction (UI:R) and crosses a security boundary (S:C, script executes in the victim's browser context). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Qi Addons For Elementor
View allThe Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ
Cross-site scripting in the WordPress plugin Qi Addons for Elementor (versions up to and including 1.11) allows an authe
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets i
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button wi
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today