Stored Cross-Site Scripting Vulnerability in Qi Addons for Elementor Plugin by WordPress

CVE-2025-8146

What is CVE-2025-8146?

The Qi Addons For Elementor plugin for WordPress is susceptible to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping on user-provided attributes in the TypeOut Text widget. This vulnerability allows authenticated attackers, with contributor-level access or higher, to inject arbitrary scripts. When users access compromised pages, these scripts can execute, leading to potential attacks such as data theft, session hijacking, or defacement. It is essential for website administrators to ensure their plugins are updated to mitigate this risk.

References