CVE-2026-105069

MediumCVSS 6.5

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS. This issue affects QR Redirector from n/a through 2.0.5.

Risk Assessment

Stored XSS may allow an attacker to inject malicious scripts that execute in users' browsers, potentially leading to session theft or data compromise.

Recommendation

It is recommended to update the QR Redirector plugin to the latest version and sanitize input data.

Other vulnerabilities in QR Redirector

CVE-2026-24545Medium
Missing authorization in the QR Redirector plugin allows exploiting incorrectly configured access control security levels. This vulnerability affects versions from n/a through 2.0.3.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS