The OpenPOS Lite – Point of Sale for WooCommerce plugin is vulnerable to a stored cross‑site scripting flaw triggered by the 'width' parameter of the order_qrcode shortcode. Authenticated users with Contributor-level privileges can inject arbitrary JavaScript. When a page containing the compromised shortcode is viewed, the injected script runs in the context of that page, giving the attacker the ability to steal session cookies, modify page content, or deface the site.

Affected installations include any WordPress site running the OpenPOS Lite plugin up to and including version 3.0. The vulnerability exists in all releases prior to 3.1 and is present wherever the order_qrcode shortcode is used in public or administrative pages.

The flaw carries a CVSS score of 6.4 (Moderate) and an EPSS probability of less than 1 %, indicating a low overall exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Because it requires only Contributor+ access, a wide range of site contributors could create the malicious payload. Once the shortcode is stored, the script executes for any visitor who loads the affected page, making the attack a persistent threat until remediation.