CVE-2023-2842

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

Cross site request forgery (csrf)

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842 WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842

CVE-2023-2842 affects the WordPress plugin WP Inventory Manager (pre-2.1.0.14). The vulnerability stems from missing CSRF checks, enabling a CSRF attack to cause logged-in admins to delete Inventory Items. Remediation: upgrade to version 2.1.0.14 or later. Reported impact aligns with CVSS v3.1: a...

PT-2023-21706 · WordPress · Wp Inventory Manager

Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.1.0.14 Description: The issue allows attackers to make logged-in admins delete Inventory Items via a CSRF attack due to the lack of CSRF checks. Recommendations: For versions prior to 2.1.0.14, update ...

WordPress plugin WP Inventory Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress WP Inventory Manager Plugin < 2.1.0.14 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Inventory Manager Type Plugin Vulnerable versions 2.1.0.14 Fixed in 2.1.0.14 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2842 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bec6aa4f94a2 Credits NGO VAN TU...

WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

The plugin does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack Send a payload to logged-in admins with a request to http://127.0.0.1/wordpress/wp-admin/admin.php?page=wpimmanageinventoryitems&action=delete&deleteid=2...

WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

The plugin does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack PoC Send a payload to logged-in admins with a request to http://127.0.0.1/wordpress/wp-admin/admin.php?page=wpimmanageinventoryitems=deleteid=2...

CVE-2023-1806

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

Cross site scripting

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

CVE-2023-1806

CVE-2023-1806 affects the WP Inventory Manager WordPress plugin prior to version 2.1.0.12. The issue is a Reflected XSS caused by insufficient sanitisation/escaping of the message parameter before output to the page, potentially exploitable against high-privilege users (e.g., administrators). Roo...

CVE-2023-1806 WP Inventory Manager < 2.1.0.12 - Reflected XSS

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...

PT-2023-17261 · WordPress · Wp Inventory Manager

Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.1.0.12 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the message parameter is not properly sanitised and escaped before being outputted back in the page...

WordPress plugin WP Inventory Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress WP Inventory Manager Plugin < 2.1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software WP Inventory Manager Type Plugin Vulnerable versions 2.1.0.13 Fixed in 2.1.0.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2123 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 4a822a5456e3 Credits daniloalbuqrq...

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. PoC 1. Go to WP Inventory Inventory Items and create a new Inventory Item. 2. Create a page and add the wpinventory shortcode. 3. View the new page on the...

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. 1. Go to WP Inventory Inventory Items and create a new Inventory Item. 2. Create a page and add the wpinventory shortcode. 3. View the new page on the frontend,...

WordPress WP Inventory Manager Plugin < 2.1.0.12 is vulnerable to Cross Site Scripting (XSS)

Software WP Inventory Manager Type Plugin Vulnerable versions 2.1.0.12 Fixed in 2.1.0.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1806 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3babb1db5641 Credits Maurice...