Qi Addons For Elementor
Monthly
Cross-site scripting in the WordPress plugin Qi Addons for Elementor (versions up to and including 1.11) allows an authenticated user holding at least Contributor privileges to supply content that is later rendered without adequate output encoding, causing arbitrary script to execute in the browser session of whichever higher-privileged user views the affected page or widget. The impact is bounded by the required Contributor account and the victim-interaction (UI:R) prerequisite, and the scope-change flag (S:C) reflects that the script runs in the context of the surrounding administrative interface rather than across a trust boundary of the plugin itself. No public exploit code has been identified at time of analysis and the flaw is not recorded in CISA KEV, so this is a moderate, not high, priority; the exact addon widget, request parameter, and output sink have not been disclosed by the reporter (Patchstack), so the precise injection point still requires vendor confirmation.
Reflected cross-site scripting (XSS) in the Qi Addons For Elementor plugin for WordPress (versions up to and including 1.11) allows unauthenticated remote attackers to inject arbitrary web scripts via the 's' search parameter, but exploitation is highly conditional: it requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., sitewide header or footer) with the 'Limit ToC to Main Page Content' option left at its default value of No, and it requires victim interaction (opening a crafted search URL). The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and no public exploit identified at time of analysis.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 18.1%.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all versions up to, and including, 1.7.0 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.6.7 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting in the WordPress plugin Qi Addons for Elementor (versions up to and including 1.11) allows an authenticated user holding at least Contributor privileges to supply content that is later rendered without adequate output encoding, causing arbitrary script to execute in the browser session of whichever higher-privileged user views the affected page or widget. The impact is bounded by the required Contributor account and the victim-interaction (UI:R) prerequisite, and the scope-change flag (S:C) reflects that the script runs in the context of the surrounding administrative interface rather than across a trust boundary of the plugin itself. No public exploit code has been identified at time of analysis and the flaw is not recorded in CISA KEV, so this is a moderate, not high, priority; the exact addon widget, request parameter, and output sink have not been disclosed by the reporter (Patchstack), so the precise injection point still requires vendor confirmation.
Reflected cross-site scripting (XSS) in the Qi Addons For Elementor plugin for WordPress (versions up to and including 1.11) allows unauthenticated remote attackers to inject arbitrary web scripts via the 's' search parameter, but exploitation is highly conditional: it requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., sitewide header or footer) with the 'Limit ToC to Main Page Content' option left at its default value of No, and it requires victim interaction (opening a crafted search URL). The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and no public exploit identified at time of analysis.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 18.1%.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all versions up to, and including, 1.7.0 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.6.7 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.