Read the docs

WP Inventory

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

WP Inventory records in CISA KEV

No WP Inventory vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Inventory Manager 4 records HIGH

Records

4 records in Wp Inventory Manager · all components

TI-2023-02663 CVE-2023-2842 · GHSA-89r6-wrjm-5xx8

WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

Priority HIGH 70

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0035 Published 2023-06-27 Fixed in 2.1.0.14
TI-2023-01996 CVE-2023-2123 · GHSA-4jpf-859w-v9gv

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01161 Published 2023-08-16 Fixed in 2.1.0.13
TI-2023-01698 CVE-2023-1806 · GHSA-g6j8-pq2x-mjcg

WP Inventory Manager < 2.1.0.12 - Reflected XSS

Priority MEDIUM 60

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-05-08 Fixed in 2.1.0.12
Open these records in search →