{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:22:00.894062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:21:51.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Qi Addons For Elementor",
          "vendor": "qodeinteractive",
          "versions": [
            {
              "lessThanOrEqual": "1.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrien Brunner"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027s\u0027 parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the \u0027Limit ToC to Main Page Content\u0027 option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T07:40:05.277Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d623d4d6-2d76-4b4e-bd8b-69fe6ae352ca?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/tags/1.11/assets/js/main.js#L3263"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/tags/1.11/assets/js/main.js#L3185"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3698642%40qi-addons-for-elementor\u0026new=3698642%40qi-addons-for-elementor"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T21:03:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-17T18:44:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Qi Addons For Elementor \u003c= 1.11 - Reflected DOM-Based Cross-Site Scripting via \u0027s\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92249",
    "datePublished": "2026-09-18T07:40:05.277Z",
    "dateReserved": "2026-09-15T20:48:10.098Z",
    "dateUpdated": "2026-09-19T14:21:51.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-92249\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-19T13:22:00.894062Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-19T14:13:04.611Z\"}}], \"cna\": {\"title\": \"Qi Addons For Elementor \u003c= 1.11 - Reflected DOM-Based Cross-Site Scripting via \u0027s\u0027 Parameter\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Adrien Brunner\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"qodeinteractive\", \"product\": \"Qi Addons For Elementor\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.11\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-15T21:03:03.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-09-17T18:44:08.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/d623d4d6-2d76-4b4e-bd8b-69fe6ae352ca?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/tags/1.11/assets/js/main.js#L3263\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/tags/1.11/assets/js/main.js#L3185\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3698642%40qi-addons-for-elementor\u0026new=3698642%40qi-addons-for-elementor\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027s\u0027 parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Table of Contents widget to be placed on a template that renders on the WordPress search-results page (e.g., a sitewide header or footer template) with the \u0027Limit ToC to Main Page Content\u0027 option left at its default value of No, so the widget scans the search-results heading that reflects the unsanitized `s` parameter.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-09-18T07:40:05.277Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-92249\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-19T14:21:51.279Z\", \"dateReserved\": \"2026-09-15T20:48:10.098Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-09-18T07:40:05.277Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}