Qr Redirector Vulnerabilities

The QR Redirector plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.0.3

Fixed in:

2.0.4

Disclosed:

May 25, 2026

CVE-2026-24545 on NVD →

The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.

CVSS:

5.4

Affected:

up to 1.6.1

Fixed in:

1.6.1

Disclosed:

Oct 18, 2021

CVE-2021-24854 on NVD →

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects

CVSS:

4.3

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Oct 18, 2021

CVE-2021-24853 on NVD →