The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS).
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.00386·Published 2021-09-20·Fixed in 1.4.5CWE-352