Avalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

An authenticated attacker with at least Contributor-level access can insert the `[avalon23_qr title="..." fixed_link="..."]` shortcode into a WordPress post or page. By supplying a malicious payload in the `title` or `fixed_link` attribute (e.g. a single quote followed by an event handler), the attacker breaks out of the single-quoted HTML attribute context and injects arbitrary JavaScript. When any user views the affected page, the injected script executes in their browser, enabling session hijacking, defacement, or further attacks. [CWE-79]

The vulnerability resides in the `avalon23_qr()` method of the `Avalon23_QR_Generator` class in `/ext/qr_generator/index.php`. The `'title'` and `'fixed_link'` shortcode attributes are passed directly into the `$data` array without sanitization or escaping, then handed to `AVALON23_HELPER::draw_html_item()` which concatenates them into single-quoted HTML attributes. No call to `esc_attr()` or any other encoding is applied before rendering.

The patch is not shown in the bundle; however, the advisory states that the fix must apply `esc_attr()` (or equivalent context-aware escaping) to the `'title'` and `'fixed_link'` attributes before they are placed into the HTML attribute string by `AVALON23_HELPER::draw_html_item()`. Without such escaping, any single-quote or special character in the user-supplied value can break the attribute boundary and inject arbitrary HTML/JavaScript.