The Qr Code and Barcode Scanner Reader plugin for WordPress contains a stored Cross‑Site Scripting flaw (CWE‑79). When untrusted input supplied to the plugin is later rendered as part of a web page, an attacker can embed malicious JavaScript that executes in the browsers of any users who view the affected content. This can lead to session hijacking, credential theft, defacement, or other client‑side compromise.

The vulnerability affects the Roberto Bottalico Qr Code and Barcode Scanner Reader WordPress plugin in all releases from the initial version through version 1.0.0. Site owners running any of these versions are potentially exposed.

The CVSS score of 6.5 classifies the flaw as medium severity. The EPSS score of under 1 % indicates that exploitation is unlikely to be widespread, and the flaw is not listed in CISA’s KEV catalog. Potential attackers would need to submit malicious data to the plugin and an unsuspecting visitor would have to load the page that displays the stored content. This reliance on user interaction reduces the likelihood of exploitation but does not eliminate it.