QR Redirector
QR Redirector (qr-redirector) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 05, 2026; the highest published CVSS base score is 6.5.
qr-redirectorCVE-2026-105069: QR Redirector: Stored cross-site scripting
The supplied CVSS vector requires a low-privilege authenticated account; the minimum WordPress role is not disclosed. Attacker-controlled content is stored and subsequently rendered without sufficient neutralization, allowing script execution in a visitor's browser under the site's origin. A victim must view the affected output; the export does not identify the field or establish that administrators are exposed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 2.0.5. The authoritative export identifies 2.0.6 as fixed for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 05, 2026 |
CVE-2026-105069
QR Redirector: Stored cross-site scripting
The supplied CVSS vector requires a low-privilege authenticated account; the minimum WordPress role is not disclosed. Attacker-controlled content is stored and subsequently rendered without sufficient neutralization, allowing script execution in a visitor's browser under the site's origin. A victim must view the affected output; the export does not identify the field or establish that administrators are exposed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 2.0.5. The authoritative export identifies 2.0.6 as fixed for this CVE.
|
2.0.6 |
CVE6.5
|
| May 25, 2026 |
CVE-2026-24545
QR Redirector: A security weakness
QR Redirector is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.0.3.
|
2.0.4 |
CVE4.3
|
| Nov 17, 2021 |
CVE-2021-24854
QR Redirector: Cross-site scripting
QR Redirector is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVEPending
|
| Nov 17, 2021 |
CVE-2021-24853
QR Redirector: Cross-site request forgery
QR Redirector is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVEPending
|