Qr Code Tag For Wc From Goaskle Com Vulnerabilities

[en] The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possi...

Affected:

up to 1.9.42

Fix:

No patched version reported

Disclosed:

Jan 7, 2026

CVE-2025-14626 on NVD →

The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVSS:

6.4

Affected:

up to 1.9.42

Fix:

No patched version reported

Disclosed:

Jan 6, 2026

CVE-2025-14626 on NVD →

The QR Code Tag for WC order emails, POS receipt emails, PDF invoices, PDF packing slips, Blog posts, Custom post types and Pages (from goaskle.com) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.36. This is due to missing or incorrect nonce validation on a fu...

CVSS:

4.3

Affected:

up to 1.9.36

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32268 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC allows Cross Site Request Forgery. This issue affects QR Code Tag for WC: from n/a through 1.9.36.

Affected:

up to 1.9.36

Fix:

No patched version reported

Disclosed:

Apr 4, 2025

CVE-2025-32268 on NVD →