WordPress.org

Resolved elo8617
(@elo8617)

8 months, 3 weeks ago

Hi,

My security extension informed me of a vulnerability in Qi addons v.1.6.3

Here is details :

Cross Site Scripting (XSS) vulnerability discovered by Rafie Muhammad (Patchstack) in WordPress Plugin Qi Addons For Elementor (versions <= 1.6.3)

Is a fix planned?

Thanks.

Viewing 7 replies - 1 through 7 (of 7 total)

Plugin Author Qode
(@qodeinteractive)

8 months, 2 weeks ago

Hello,

Thank you for reaching us!

We have forwarded this to our dev team to investigate. Could you please let us know is there any other info provided by this tool so we can take a closer look?

Best,
Qode

slavisamonobunt
(@slavisamonobunt)

8 months, 2 weeks ago

There are 2 holes, here are links:

https://patchstack.com/database/vulnerability/qi-addons-for-elementor/wordpress-qi-addons-for-elementor-plugin-1-6-3-cross-site-scripting-xss-vulnerability

https://patchstack.com/database/vulnerability/qi-addons-for-elementor/wordpress-qi-addons-for-elementor-plugin-1-6-3-local-file-inclusion-vulnerability

You should update plugin today.

Thread Starter elo8617
(@elo8617)

8 months, 2 weeks ago

Hi,

Thanks for your answer.

In fact, there is two vulnerabilities detected.

Here are the corresponding links :

https://patchstack.com/database/vulnerability/qi-addons-for-elementor/wordpress-qi-addons-for-elementor-plugin-1-6-3-local-file-inclusion-vulnerability?_a_id=431

https://patchstack.com/database/vulnerability/qi-addons-for-elementor/wordpress-qi-addons-for-elementor-plugin-1-6-3-cross-site-scripting-xss-vulnerability?_a_id=431

Waiting for your feedback.

Regards

loomedisto
(@loomedisto)

8 months, 2 weeks ago

I’m getting this too, please fix.

Plugin Author Qode
(@qodeinteractive)

8 months, 2 weeks ago

Hi,

The plugin has been updated and the fix is included in the update.

Best,
Qode

mairag
(@mairag)

7 months, 3 weeks ago

Hello, Solid WP is still marking this vulnerability as not solved, I have Qi v 1.6.6, it seems they are not updating the info…

Plugin Author Qode
(@qodeinteractive)

7 months, 2 weeks ago

Hello,

The screenshot shows results for version 1.6.3. The fix is included in the latest version of plugin.

Best,
Qode

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Cross Site Scripting (XSS) vulnerability’ is closed to new replies.