CVE-2026-105069 in QR Redirector Plugin
Summary
by MITRE • 10/05/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the Nikki Blight QR Redirector plugin for WordPress, affecting versions ranging from n/a through 2.0.5. Unlike reflected XSS attacks where malicious scripts are executed via manipulated URLs in real-time, stored vulnerabilities involve the persistence of malicious payloads on the target server. In this context, an attacker can inject executable JavaScript code into fields that are subsequently rendered by the application without proper sanitization or encoding. When other users access pages containing these QR redirect configurations, their browsers execute the injected script, leading to a compromise of client-side security.
The technical root cause lies in the insufficient validation and escaping mechanisms applied to user-supplied input before it is stored in the database and later rendered back into HTML output. The plugin likely accepts data such as custom labels, descriptions, or redirect targets from administrators or users with sufficient privileges and fails to apply context-appropriate encoding rules. This oversight allows special characters like angle brackets, quotes, and ampersands to pass through unaltered, enabling the injection of arbitrary JavaScript code into the DOM structure. Because the payload is stored server-side, it does not require social engineering tactics to trick a user into clicking a specific link; rather, any visitor viewing the compromised page becomes an unwitting victim of the attack vector.
The operational impact of this vulnerability is significant due to its persistent nature and potential for widespread exploitation. Successful exploitation allows attackers to perform session hijacking by stealing authentication cookies or tokens displayed in clear text within browser memory. This can lead to unauthorized access to administrative accounts, effectively granting full control over the WordPress installation. Furthermore, stored XSS enables phishing attacks where malicious forms are injected into legitimate pages to harvest credentials from unsuspecting visitors. Attackers may also deface websites, redirect traffic to malicious domains for malware distribution, or use compromised sites as part of larger botnets. The severity is amplified by the fact that QR codes often direct users to external services, meaning a successful exploit could compromise not just the local site but potentially lead users into broader phishing ecosystems designed to steal sensitive information from mobile and desktop devices alike.
From an industry standards perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). It is also mapped within the MITRE ATT&CK framework under techniques such as T1059.007 JavaScript for client-side code execution and potentially T1189 Drive-by Compromise if used to deliver malware via redirected QR codes. The persistence of the payload places it firmly in the category of stored attacks, which are generally considered more dangerous than reflected variants due to their automated delivery mechanism upon page load.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. Users running affected versions should immediately upgrade Nikki Blight QR Redirector to version 2.0.6 or later, where the developer has presumably implemented proper input validation and output encoding. For organizations unable to update immediately due to compatibility constraints, implementing a Web Application Firewall (WAF) can provide temporary protection by filtering out malicious payloads containing script tags or event handlers before they reach the application logic. Additionally, developers should enforce strict Content Security Policy headers that restrict inline script execution, thereby neutralizing many XSS attempts even if input validation fails. Future development must prioritize context-aware encoding for all dynamic content and utilize parameterized queries to prevent injection attacks at both the presentation and data layers.