The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin fails to sanitize and escape the attributes supplied to its shortcodes, creating a stored XSS flaw. An authenticated user with contributor rights or higher can embed malicious JavaScript that will execute in the browser of any user who later views an order email, PDF invoice, or packing slip containing the injected shortcode. This allows attackers to hijack sessions, deface content, or exfiltrate data, compromising the confidentiality, integrity, and availability of the site’s front‑end.

The issue is present in all releases of the QR Code for WooCommerce order emails, PDF invoices, packing slips plugin up to and including version 1.9.42 on WordPress. Sites running these versions with contributors, editors, administrators, or higher roles are affected. No other vendors or products are listed.

The vulnerability carries a CVSS score of 6.4, placing it in the moderate range, and its EPSS score of less than 1 % indicates a very low likelihood of exploitation in the near term. It is not included in CISA’s KEV catalog. The attack vector requires authenticated access with a contributor role or higher; attackers can inject the payload via the shortcode in order‑related emails or PDF invoices, and the stored code will run for all recipients who view the affected documents.