CVE-2026-24614: 
WordPress vulnerability analysis and mitigation

CVE-2026-24614 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Devsbrain Flex QR Code Generator WordPress plugin, classified under CWE-79. It affects all versions of the plugin through 1.2.10 (initially reported as through 1.2.8, later updated to 1.2.10, and Patchstack's database notes 1.2.11 as still vulnerable with no official patch). The vulnerability was reported by researcher Jitlada on December 13, 2025, and published by Patchstack on January 12, 2026, with NVD publication on January 23, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack, NVD).

The vulnerability is rooted in improper neutralization of user-supplied input during web page generation (CWE-79), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, the attack payload is injected and executed entirely within the browser's Document Object Model without requiring a server-side reflection, meaning the malicious script is processed by the client-side JavaScript of the plugin. Exploitation requires the attacker to have at least Author-level privileges on the WordPress site and also requires a victim user (such as an administrator) to interact with a crafted page or link. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker with Author-level access to inject malicious JavaScript into pages rendered by the Flex QR Code Generator plugin, which executes in the context of a victim user's browser session. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (including privilege escalation if an administrator is targeted), and injection of malicious redirects or advertisements into the WordPress site. The confidentiality, integrity, and availability impacts are each rated Low, with a changed scope indicating the attack can affect resources beyond the vulnerable component (Patchstack).

No active in-the-wild exploitation has been reported for CVE-2026-24614, and no exploit kits or weaponized code are publicly known. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for Author-level privileges and victim user interaction, limiting the attack surface (Patchstack).

1. Gain Author-level access: Obtain or compromise an account with at least Author privileges on the target WordPress site running Flex QR Code Generator <= 1.2.11.
2. Craft a malicious QR code entry: Create or edit a QR code entry within the plugin, injecting a DOM-Based XSS payload into an input field that is processed by the plugin's client-side JavaScript (e.g., a QR code label or URL field that is reflected into the DOM without sanitization).
3. Deliver the payload to a victim: Share or embed the crafted page/post containing the malicious QR code widget with a higher-privileged user (e.g., an administrator), via a direct link or by publishing the content.
4. Trigger execution: When the victim visits the page, the browser processes the plugin's JavaScript, which reads the unsanitized input from the DOM and executes the injected script in the victim's browser context.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim (e.g., create rogue admin accounts), or redirect the victim to a phishing site (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages containing the Flex QR Code Generator plugin with encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in plugin-related parameters.
• File System: Unexpected modifications to WordPress post content or plugin files containing obfuscated JavaScript strings.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the QR code plugin, potentially indicating data exfiltration (e.g., cookie theft via document.cookie).
• Logs: WordPress audit logs (if enabled) showing Author-level users creating or editing QR code entries with unusual content, or administrator accounts performing unexpected actions (e.g., new admin user creation) without corresponding login activity.

As of the time of reporting, no official patched version has been released by Devsbrain for the Flex QR Code Generator plugin; Patchstack notes versions through 1.2.11 remain vulnerable with no official patch available. Site administrators should consider deactivating and removing the plugin until a patched version is released. As a compensating control, restrict Author-level account creation and monitor for suspicious content in QR code plugin entries. Patchstack's virtual patching service can provide interim protection for subscribers (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the week of January 12–18, 2026, as part of routine plugin vulnerability tracking. Patchstack, which discovered and disclosed the vulnerability through researcher Jitlada, classifies it as low priority with unlikely exploitation impact. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been identified.