CVE-2025-14626: 
WordPress vulnerability analysis and mitigation

CVE-2025-14626 is a Stored Cross-Site Scripting (XSS) vulnerability in the "QR Code for WooCommerce order emails, PDF invoices, packing slips" WordPress plugin. It affects all versions up to and including 1.9.42, and was disclosed on January 7, 2026, with the CVE assigned by Wordfence. The flaw allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts via the plugin's shortcode attributes. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's shortcode. The vulnerable code is located in lib/qrct/QrctWp.php at line 1661, as referenced in the WordPress plugin repository. An authenticated attacker with at least contributor-level access can embed a malicious shortcode containing JavaScript into a post or page; the script executes in the browser of any user who subsequently visits that page (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the context of any visitor's browser on affected WordPress sites, enabling session hijacking, credential theft, phishing redirects, or defacement. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the plugin itself to the broader WordPress environment and its users. Confidentiality and integrity are both partially compromised, though availability is not directly affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14626 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "QR Code for WooCommerce" plugin (slug: qr-code-tag-for-wc-from-goaskle-com) at version 1.9.42 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create a new post or page and insert the plugin's shortcode with a malicious JavaScript payload embedded in a user-supplied attribute, e.g., [qrct_tag attribute="\"onmouseover=\"alert(document.cookie)"] or similar unsanitized parameter.
4. Publish or save the content: Submit the post/page (even as a draft if it can be previewed by others, or publish it directly).
5. Trigger execution: When any site visitor or administrator loads the injected page, the malicious script executes in their browser, potentially stealing session cookies, redirecting to phishing pages, or performing actions on behalf of the victim (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing shortcode attributes with JavaScript event handlers (e.g., onerror, onload, onmouseover) or <script> tags.
• File System: Unexpected modifications to posts or pages in the WordPress database (wp_posts table) containing the plugin's shortcode with embedded script content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the plugin's shortcode, potentially indicating data exfiltration (e.g., cookie theft via document.location redirects).
• Logs: WordPress audit logs (if enabled via plugins like WP Activity Log) recording post edits by contributor-level accounts inserting shortcode content with unusual attribute values.

Site administrators should update the "QR Code for WooCommerce order emails, PDF invoices, packing slips" plugin to version 1.9.43 or later, which contains the fix for this vulnerability. As a temporary workaround, restrict contributor-level user permissions or disable the plugin until patching is feasible. Additionally, review existing posts and pages for any shortcode instances containing suspicious JavaScript payloads (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 7, 2026. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified for this vulnerability, consistent with its medium severity and limited exploitation prerequisites.