CVE-2021-24854

5.4 mediumEPSS 0.6%

Medium (5.4) in qr redirector project qr redirector. EPSS 0.6% chance of exploitation in the next 30 days.

The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-11-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

qr_redirector_project:qr_redirector

References

https://wpscan.com/vulnerability/0d422397-69ff-4d05-aafa-7a572e460e5f
https://wpscan.com/vulnerability/0d422397-69ff-4d05-aafa-7a572e460e5f

Check your stack JSON