Cross-site Scripting in Flex QR Code Generator by Devsbrain
CVE-2026-24614

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Flex Qr Code Generator
Vendor
CVE Published:
23 January 2026

What is CVE-2026-24614?

The Flex QR Code Generator by Devsbrain has a vulnerability that allows for Cross-site Scripting (XSS) due to improper input handling during web page generation. This flaw can potentially enable an attacker to execute arbitrary JavaScript in a user's browser session, leading to compromised user data and security breaches. The vulnerability impacts versions of the product up to 1.2.8, emphasizing the need for users to upgrade to secure their applications against such threats.

Affected Version(s)

Flex QR Code Generator 0 <= 1.2.10

References

https://patchstack.com/database/Wordpress/Plugin/flex-qr-...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jitlada | Patchstack Bug Bounty Program
.