CVE-2026-1397

Name of the Vulnerable Software and Affected Versions PQ Addons – Creative Elementor Widgets versions prior to 1.0.1

Description The PQ Addons – Creative Elementor Widgets plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping on the html tag parameter within the PQ Section Title widget. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page.

Recommendations Update PQ Addons – Creative Elementor Widgets to version 1.0.1 or later.