CVE-2022-3847

6.1 mediumEPSS 0.3%

Medium (6.1) in showing url in qr code project showing url in qr code. EPSS 0.3% chance of exploitation in the next 30 days.

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
Published: 2022-11-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

showing_url_in_qr_code_project:showing_url_in_qr_code

References

https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/
https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6
https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/
https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6

Check your stack JSON