CVE-2026-62079

MediumCVSS 6.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Qi Addons For Elementor plugin version 1.11 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Risk Assessment

Risk of malicious script execution in the user's browser, potentially leading to data theft or session hijacking.

Recommendation

Update the Qi Addons For Elementor plugin to the latest available version that includes the fix.

Other vulnerabilities in Qi Addons For Elementor

CVE-2026-92249Medium
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS