QR Redirector CVE-2026-105069

Exploitation requires (1) an authenticated WordPress account with at least low-privilege content-submission rights per the CVSS PR:L, allowing the attacker to store a payload via QR Redirector's redirect-entry functionality, and (2) a higher-privileged victim (typically an administrator) to subsequently view the page rendering the stored input, per UI:R. Limiting factors: this is NOT remote-unauthenticated - an attacker must already hold a plugin/site account, so single-operator sites or those with no untrusted authenticated users face substantially reduced exposure. Affected versions are QR Redirector up to and including 2.0.5.

This is a moderate-severity Stored XSS (CWE-79) in the QR Redirector WordPress plugin, rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals point to a real but not urgent issue. The attack vector is network-based with low complexity, but exploitation requires PR:L (an authenticated low-privilege account, e.g. a contributor/author who can submit content) AND UI:R (an administrator or other user must view the injected content), which meaningfully constrains real-world abuse. The scope change (S:C) reflects that injected script executes in the victim's browser context - the classic multiplier for stored XSS, enabling admin-session hijacking. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatable mass-exploitation; this is a Patchstack-reported research finding. Verdict: a genuine but second-tier priority - patch during normal cycles rather than emergency response, with higher urgency on multi-author sites where untrusted low-privilege users exist. Note the privilege prerequisite (PR:L) materially lowers the practical risk below what the 6.5 score suggests for single-admin sites.

A low-privileged authenticated user (such as a contributor) on a WordPress site running QR Redirector ≤2.0.5 submits a crafted QR redirect entry containing a malicious script payload that is stored without proper neutralization. When an administrator later views the affected plugin page in wp-admin, the script executes in their browser session, potentially stealing session cookies or performing actions as the admin. No public exploit code was identified at time of analysis.