Improper neutralization of input in Luke America WCS QR Code Generator allows stored cross‑site scripting on WordPress sites. The plugin accepts data that is later rendered in a web page without proper escaping, enabling an attacker to inject malicious JavaScript that runs in the context of any user who visits the affected page. This can lead to session hijacking, defacement, data exfiltration or defacement of the WordPress site.

The vulnerability is present in all installed versions of the WCS QR Code Generator plugin up to and including version 1.0, which is distributed by Luke America for WordPress.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low overall likelihood of exploitation at this time; the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a stored XSS that can be triggered from the plugin’s QR code creation interface, usually requiring an authenticated user with permission to add or edit content. A successful exploit would allow an attacker to run arbitrary client‑side code in the browsers of visitors to the affected site.