PT-2025-46277 · WordPress · Usb Qr Code Scanner For Woocommerce

Dayea Song · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12588

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions USB Qr Code Scanner For Woocommerce plugin for WordPress versions prior to 1.0.1

Description The USB Qr Code Scanner For Woocommerce plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is a result of a lack of nonce validation on the settings page. An unauthenticated attacker could potentially update the plugin’s settings by forging a request, provided they can trick an administrator into performing an action, such as clicking a malicious link.

Recommendations Update the USB Qr Code Scanner For Woocommerce plugin for WordPress to version 1.0.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-12588

Affected Products

Usb Qr Code Scanner For Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12588 · Security Note
• https://twitter.com/VulmonFeeds/status/1988255148343185411 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6e02d105-0f1e-479e-a537-7a7fdbbd7804?source=cve · Note
• https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L149 · Note
• https://twitter.com/CVEnew/status/1988095323831459906 · Twitter Post
• https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L410 · Note
• https://t.me/CVEtracker/36980 · Telegram Post