CVE-2026-92249: Qi Addons For Elementor XSS Vulnerability

CVE-2026-92249 Overview

CVE-2026-92249 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Qi Addons For Elementor plugin for WordPress. The flaw affects all versions up to and including 1.11. Unauthenticated attackers can inject arbitrary web scripts through the s (search) parameter, which the Table of Contents widget reflects into rendered pages without proper sanitization or output escaping. Successful exploitation requires a victim to click a crafted link and depends on the site using the Table of Contents widget in a template that renders on the WordPress search-results page with Limit ToC to Main Page Content set to its default value of No. The issue is tracked under CWE-79.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and forced administrative actions when a logged-in administrator is targeted.

Affected Products

Qi Addons For Elementor plugin for WordPress — all versions up to and including 1.11
WordPress sites where the Table of Contents widget renders on search-results templates
WordPress sites where Limit ToC to Main Page Content is left at its default value of No

Discovery Timeline

2026-09-18 - CVE-2026-92249 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-92249

Vulnerability Analysis

The vulnerability originates in the Table of Contents (ToC) widget shipped with Qi Addons For Elementor. When the widget renders on a template that also appears on the WordPress search-results page, such as a sitewide header or footer, it parses headings within the page DOM. On search pages, WordPress reflects the query string from the s parameter directly into the search-results heading. The ToC widget reads that heading and reinserts it into the page without sanitizing input or escaping output, allowing attacker-supplied markup to execute as script. Because exploitation requires the victim to open a crafted URL, user interaction is a precondition. The referenced client-side logic in the plugin's assets/js/main.js file at lines 3185 and 3263 contains the unsafe handling.

Root Cause

The root cause is insufficient input sanitization and output escaping in the ToC widget's heading-collection routine. The widget trusts DOM content produced from user-controllable request parameters and writes it back into the rendered page without encoding HTML entities or stripping active content.

Attack Vector

An attacker crafts a URL to the target WordPress site containing a malicious payload in the s query parameter. When a victim visits the link, the search-results page renders the attacker payload into the results heading. The Table of Contents widget then propagates that payload into the page, executing script in the victim's browser under the site's origin. See the Wordfence Vulnerability Report for additional detail. No authentication is required, and the attack can be delivered through phishing, malicious ads, or forum posts.

No verified proof-of-concept code is available. Technical detail is referenced in the plugin source at main.js line 3185 and main.js line 3263.

Detection Methods for CVE-2026-92249

Indicators of Compromise

Web server access logs containing requests to /?s= with URL-encoded HTML tags such as %3Cscript%3E, onerror=, onload=, or javascript: payloads.
Referrer strings pointing to attacker-controlled domains that redirect users to the site's search URL with encoded script content.
Unexpected outbound requests from browser sessions to unfamiliar domains shortly after visits to search URLs.
WordPress admin sessions performing unusual privileged actions immediately after loading a search-results page.

Detection Strategies

Inspect HTTP request logs for the s query parameter containing angle brackets, event handler attributes, or encoded JavaScript URIs.
Deploy a Web Application Firewall (WAF) rule that inspects and blocks XSS payload patterns in the s parameter.
Correlate reflected requests with subsequent authenticated admin activity from the same client to surface session compromise.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions and script-src violations.
Alert on WordPress admin actions that follow shortly after a session visited a ?s= URL with suspicious parameters.
Monitor plugin file integrity on the Qi Addons For Elementor directory to detect tampering during response.

How to Mitigate CVE-2026-92249

Immediate Actions Required

Update the Qi Addons For Elementor plugin to a version later than 1.11 as soon as the vendor publishes a fixed release.
Audit Elementor templates and remove or relocate the Table of Contents widget from any template that renders on search-results pages until patched.
Set the Limit ToC to Main Page Content option to Yes on every Table of Contents widget instance.
Deploy WAF signatures that reject XSS payloads in the s query parameter.

Patch Information

The vendor has committed a fix as recorded in WordPress Plugin Changeset 3698642. Administrators should apply the patched plugin release once available in the WordPress plugin repository and verify the version through the WordPress admin dashboard.

Workarounds

Toggle Limit ToC to Main Page Content to Yes on all Table of Contents widget instances, which restricts the widget from scanning reflected search headings.
Remove the Table of Contents widget from sitewide header and footer templates so it does not render on /?s= URLs.
Temporarily deactivate the Qi Addons For Elementor plugin if the widget cannot be reconfigured in a timely manner.
Add a WAF rule blocking requests where the s parameter contains <, >, or common XSS event-handler substrings.

bash

# Example ModSecurity rule to block XSS payloads in the WordPress search parameter
SecRule ARGS:s "@rx (?i)(<script|onerror=|onload=|javascript:|<svg|<iframe)" \
    "id:1092249,phase:2,deny,status:403,log,msg:'Blocked XSS in WordPress s parameter (CVE-2026-92249)'"