Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: WP Inventory Clear all filters
TI-2026-41595 CVE-2026-57772 · GHSA-9f7m-6v2m-8r5x

WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability

Priority LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Mana…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00357 Published 2026-07-13 No fix listed CWE-89
TI-2023-01996 CVE-2023-2123 · GHSA-4jpf-859w-v9gv

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01161 Published 2023-08-16 Fixed in 2.1.0.13
TI-2023-02663 CVE-2023-2842 · GHSA-89r6-wrjm-5xx8

WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

Priority HIGH 70

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0035 Published 2023-06-27 Fixed in 2.1.0.14
TI-2023-01698 CVE-2023-1806 · GHSA-g6j8-pq2x-mjcg

WP Inventory Manager < 2.1.0.12 - Reflected XSS

Priority MEDIUM 60

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2023-05-08 Fixed in 2.1.0.12