Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: WP Inventory Component: Wp Inventory Manager Clear all filters
TI-2023-01996 CVE-2023-2123 · GHSA-4jpf-859w-v9gv

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01161 Published 2023-08-16 Fixed in 2.1.0.13
TI-2023-02663 CVE-2023-2842 · GHSA-89r6-wrjm-5xx8

WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

Priority HIGH 70

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0035 Published 2023-06-27 Fixed in 2.1.0.14
TI-2023-01698 CVE-2023-1806 · GHSA-g6j8-pq2x-mjcg

WP Inventory Manager < 2.1.0.12 - Reflected XSS

Priority MEDIUM 60

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-05-08 Fixed in 2.1.0.12