Kaya QR Code Generator, 1e00947396c1019d0f5e935ec5c63a4dcbba7bac

CVE, Research URL: 1e00947396c1019d0f5e935ec5c63a4dcbba7bac
Home page URL: Security reports for Kaya QR Code Generator
Application: Kaya QR Code Generator
Published on: Apr 13, 2023
Research Description: Kaya QR Code Generator [kaya-qr-code-generator] < 1.5.3 Kaya QR Code Generator <= 1.5.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via url parameter The Kaya QR Code Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter passed to the 'wpkqcg_doDisplayQRCode' function via multiple methods including shortcodes in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.5.3.
Status: vulnerable