Flex Qr Code Generator Vulnerabilities

The Flex QR Code Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 1.2.11

Fixed in:

1.2.12

Disclosed:

Jan 12, 2026

CVE-2026-24614 on NVD →

The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may...

CVSS:

9.8

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Dec 5, 2025

CVE-2025-12673 on NVD →

The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which...

CVSS:

9.8

Affected:

up to 1.2.5

Fixed in:

1.2.6

Disclosed:

Oct 14, 2025

CVE-2025-10041 on NVD →