CVE-2025-14626: WooCommerce QR Code Plugin XSS Vulnerability

CVE-2025-14626 Overview

CVE-2025-14626 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress. The vulnerability exists in all versions up to and including 1.9.42 due to insufficient input sanitization and output escaping on user-supplied attributes within the plugin's shortcode functionality.

This vulnerability allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into WordPress pages. These malicious scripts execute whenever any user accesses the compromised page, potentially leading to session hijacking, credential theft, or further exploitation of site visitors.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the browsers of all users viewing affected pages, enabling session hijacking, data theft, and potential account takeover.

Affected Products

• QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress versions ≤ 1.9.42
• WordPress sites using the vulnerable plugin with contributor-level or higher user accounts
• WooCommerce installations utilizing QR code functionality for order communications

Discovery Timeline

• 2026-01-07 - CVE-2025-14626 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14626

Vulnerability Analysis

This Stored XSS vulnerability stems from improper handling of user-controlled input within the plugin's shortcode implementation. The vulnerable code resides in the QrctWp.php file at line 1661, where shortcode attributes are processed without adequate sanitization before being rendered in the page output.

When a user with contributor-level privileges or higher creates or edits content containing the plugin's shortcode, they can craft malicious attribute values containing JavaScript payloads. Because the plugin fails to properly sanitize these inputs or escape the output, the malicious script is stored in the WordPress database and subsequently executed in the browsers of all users who view the affected page.

The network-accessible attack vector combined with the low attack complexity makes this vulnerability relatively easy to exploit. While authentication is required (contributor-level access), the scope change means the impact extends beyond the vulnerable component itself, potentially affecting other components within the WordPress ecosystem.

Root Cause

The root cause is insufficient input sanitization and output escaping (CWE-79) in the shortcode processing logic within lib/qrct/QrctWp.php. The plugin accepts user-supplied attributes through its shortcode functionality but fails to properly validate, sanitize, or escape these values before incorporating them into the rendered HTML output. This allows attackers to inject arbitrary JavaScript that persists in the database and executes on page load.

Attack Vector

The attack leverages the plugin's shortcode functionality through the following mechanism:

1. An attacker with contributor-level WordPress access creates or edits a post/page
2. The attacker inserts the plugin's shortcode with crafted malicious attributes containing JavaScript payload
3. The plugin processes the shortcode without proper sanitization, storing the malicious content
4. When any user (including administrators) views the affected page, the injected script executes in their browser context
5. The malicious script can steal session cookies, perform actions as the victim user, or redirect to phishing pages

The vulnerability is particularly concerning because stored XSS payloads persist and can affect multiple users over time, including site administrators with elevated privileges. For technical details on the vulnerable code path, see the WordPress Plugin Source Code.

Detection Methods for CVE-2025-14626

Indicators of Compromise

• Unexpected JavaScript code within post or page content containing the QR Code plugin shortcode
• Unusual shortcode attribute values containing script tags, event handlers, or encoded JavaScript
• Browser console errors or unexpected network requests when viewing pages with QR code shortcodes
• Reports of suspicious redirects or popup alerts from site visitors

Detection Strategies

• Review WordPress database for posts/pages containing the plugin's shortcode with suspicious attribute patterns
• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in shortcode parameters
• Monitor WordPress audit logs for content modifications by contributor-level users involving the QR Code plugin
• Scan existing content using WordPress security plugins capable of detecting stored XSS patterns

Monitoring Recommendations

• Enable detailed logging of all post and page modifications, particularly those involving shortcode usage
• Configure alerts for JavaScript-related content patterns within WordPress post metadata
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks
• Regularly audit user accounts with contributor-level access and above for unauthorized activity

How to Mitigate CVE-2025-14626

Immediate Actions Required

• Update the QR Code for WooCommerce order emails, PDF invoices, packing slips plugin to a version newer than 1.9.42
• Review and audit all existing pages and posts containing the plugin's shortcode for malicious content
• Temporarily restrict contributor-level access if immediate patching is not possible
• Implement Content Security Policy headers to reduce XSS impact

Patch Information

Organizations should update to the latest version of the QR Code for WooCommerce plugin that addresses this vulnerability. The fix involves proper input sanitization and output escaping for shortcode attributes. Refer to the Wordfence Vulnerability Report for the latest patch status and security advisory details.

Workarounds

• Temporarily deactivate the QR Code for WooCommerce plugin until a patched version can be applied
• Revoke contributor-level access from untrusted users to prevent exploitation
• Implement server-side input filtering to strip potentially malicious content from shortcode attributes
• Deploy a Web Application Firewall with XSS protection rules as an additional defense layer

# WordPress CLI command to check plugin version
wp plugin list --name=qr-code-tag-for-wc-from-goaskle-com --fields=name,version,status

# Update the plugin to latest version
wp plugin update qr-code-tag-for-wc-from-goaskle-com

# Temporarily deactivate if update unavailable
wp plugin deactivate qr-code-tag-for-wc-from-goaskle-com