Qi Addons For Elementor Vulnerabilities

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 1.9.2

Fixed in:

1.9.3

Disclosed:

Aug 1, 2025

CVE-2025-8146 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inj...

CVSS:

6.4

Affected:

up to 1.9.1

Fixed in:

1.9.2

Disclosed:

Jun 27, 2025

CVE-2025-6252 on NVD →

[en] The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abov...

Affected:

up to 1.8.8

Fixed in:

1.8.8

Disclosed:

Feb 4, 2025

CVE-2024-13699 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVSS:

6.4

Affected:

up to 1.8.7

Fixed in:

1.8.8

Disclosed:

Feb 3, 2025

CVE-2024-13699 on NVD →

[en] The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templa...

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Oct 23, 2024

CVE-2024-9530 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates t...

CVSS:

4.3

Affected:

up to 1.8.0

Fixed in:

1.8.1

Disclosed:

Oct 22, 2024

CVE-2024-9530 on NVD →

[en] The Qi Addons For Elementor plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jun 7, 2024

CVE-2024-4887 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inclu...

CVSS:

7.5

Affected:

up to 1.7.2

Fixed in:

1.7.3

Disclosed:

Jun 6, 2024

CVE-2024-4887 on NVD →

[en] The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

Affected:

up to 1.7.3

Fixed in:

1.7.3

Disclosed:

Jun 6, 2024

CVE-2024-4364 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button widgets in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contr...

CVSS:

6.4

Affected:

up to 1.7.2

Fixed in:

1.7.3

Disclosed:

Jun 5, 2024

CVE-2024-4364 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QODE Interactive Qi Addons For Elementor allows PHP Local File Inclusion.This issue affects Qi Addons For Elementor: from n/a through 1.6.3.

Affected:

up to 1.6.4

Fixed in:

1.6.4

Disclosed:

May 17, 2024

CVE-2023-47679 on NVD →

[en] The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and...

Affected:

up to 1.7.1

Fixed in:

1.7.1

Disclosed:

Apr 27, 2024

CVE-2024-3309 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget's attributes in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and abov...

CVSS:

6.4

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Apr 26, 2024

CVE-2024-3309 on NVD →

[en] The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribu...

Affected:

up to 1.6.8

Fixed in:

1.6.8

Disclosed:

Apr 9, 2024

CVE-2024-0826 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-l...

CVSS:

6.4

Affected:

up to 1.6.7

Fixed in:

1.6.8

Disclosed:

Mar 18, 2024

CVE-2024-0826 on NVD →

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Qode Interactive Qi Addons For Elementor plugin <= 1.6.3 versions.

Affected:

up to 1.6.5

Fixed in:

1.6.5

Disclosed:

Nov 13, 2023

CVE-2023-47680 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in...

CVSS:

8.8

Affected:

up to 1.6.3

Fixed in:

1.6.4

Disclosed:

Nov 9, 2023

CVE-2023-47679 on NVD →

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVSS:

6.4

Affected:

up to 1.6.4

Fixed in:

1.6.5

Disclosed:

Nov 9, 2023

CVE-2023-47680 on NVD →

Affected:

up to 1.9.2

Fixed in:

1.9.2

CVE-2025-6252 on NVD →

Affected:

up to 1.9.3

Fixed in:

1.9.3

CVE-2025-8146 on NVD →