PT-2026-1638 · WordPress · Qr Code For Woocommerce Order Emails

Athiwat Tiprasaharn + 4 · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-14626

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress versions through 1.9.42

Description The plugin is susceptible to Stored Cross-Site Scripting through its shortcode due to inadequate input sanitization and output escaping of user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page.

Recommendations Update the QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress to a version later than 1.9.42.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-14626

Produtos afetados

Qr Code For Woocommerce Order Emails

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/5b2e599c-48de-4d3a-94a3-b98badfb7a98?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/qr-code-tag-for-wc-from-goaskle-com/tags/1.9.42/lib/qrct/QrctWp.php#L1661 · Nota
• https://plugins.trac.wordpress.org/browser/qr-code-tag-for-wc-from-goaskle-com/trunk/lib/qrct/QrctWp.php#L1661 · Nota
• https://t.me/CVEtracker/41587 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-14626 · Nota de Segurança
• https://twitter.com/CVEnew/status/2008838590415921610 · Publicação no Twitter