Stored Cross-Site Scripting Vulnerability in QR Code for WooCommerce by GoAskle

CVE-2025-14626

What is CVE-2025-14626?

The QR Code for WooCommerce order emails, PDF invoices, and packing slips plugin for WordPress exposes a vulnerability that could allow authenticated attackers with contributor-level access and higher to exploit the plugin's shortcode functionality. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes, enabling the injection of arbitrary web scripts. Such scripts will execute on pages accessed by users, presenting significant security risks for site integrity and visitor safety. It is crucial for users of this plugin to ensure they update to the latest version to mitigate potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References