CVE-2026-115183

{
  "etk_id": "ETK-2026-2579",
  "cve_id": "CVE-2026-115183",
  "display_id": "CVE-2026-115183",
  "ghsa_id": "GHSA-q3pm-872x-6qfr",
  "euvd_id": "EUVD-2026-109351",
  "status": "published",
  "anchor_state": "anchored",
  "title": "HTML form injection in Qi Addons for Elementor",
  "summary": "Qi Addons for Elementor releases before 1.11.2 can allow insufficiently filtered widget-heading content to introduce active HTML forms into posts. An authenticated user with Contributor privileges or higher could use this to present forms that send submitted data to an external destination.",
  "mitigation": "Update Qi Addons for Elementor to version 1.11.2 or later. Until updates are complete, restrict Contributor and higher roles to trusted users and review published content for unexpected forms.",
  "vendor": null,
  "product": "Qi Addons For Elementor",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.11.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.11.2"
      ],
      "package_name": "Qi Addons For Elementor",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 21.556029733333332,
  "t0_at": "2026-10-25T06:00:21.850000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-25T07:16:20.827042+00:00",
      "days": 0.05276593798611111,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T06:00:21.850000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-25T06:00:21.850000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T06:00:21.850000+00:00",
      "url": "https://github.com/advisories/GHSA-q3pm-872x-6qfr"
    }
  }
}