PT-2026-1638 · WordPress · Qr Code For Woocommerce Order Emails

Athiwat Tiprasaharn + 4 · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-14626

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress versions through 1.9.42

Description The plugin is susceptible to Stored Cross-Site Scripting through its shortcode due to inadequate input sanitization and output escaping of user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page.

Recommendations Update the QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress to a version later than 1.9.42.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14626

Affected Products

Qr Code For Woocommerce Order Emails

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14626 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5b2e599c-48de-4d3a-94a3-b98badfb7a98?source=cve · Note
• https://plugins.trac.wordpress.org/browser/qr-code-tag-for-wc-from-goaskle-com/tags/1.9.42/lib/qrct/QrctWp.php#L1661 · Note
• https://plugins.trac.wordpress.org/browser/qr-code-tag-for-wc-from-goaskle-com/trunk/lib/qrct/QrctWp.php#L1661 · Note
• https://t.me/CVEtracker/41587 · Telegram Post
• https://twitter.com/CVEnew/status/2008838590415921610 · Twitter Post