poc-cve-xss-encoded-wp-inventory-manager-plugin

Actualización - 5/10/2023 El ID CVE-2023-2123 fue reservado y el PoC fue publicado en el sitio web de WPScan: https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1 Detalles Título: Cross-Site Scripting Reflejado No Autenticado en el Plugin WP Inventory Manager para WordPress CMS...

CVE-2026-17607

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-17607 WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-17607 WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

EUVD-2026-82749

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-17607

WP Inventory Manager plugin for WordPress (versions ≤ 2.5.1) is vulnerable to SQL Injection via the 'where' attribute of the [wpinventory] shortcode. The root cause is in the WPIMItem::get_all() function, where parse_custom_where() performs only html_entity_decode(), semicolon stripping, and fiel...

CVE-2026-17607: Improper Neutralization of Special Elements used in an SQL Command

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-90887

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

EUVD-2026-81521

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

CVE-2026-90887

WP Inventory Manager (WordPress plugin, versions

CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

CVE-2026-90887: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sorawautsukushiii in WordPress Plugin WP Inventory Manager versions = 2.5.4...

CVE-2026-57772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through = 2.4.0...

CVE-2026-57772: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through = 2.4.0...

EUVD-2023-38126

Malicious code in bioql PyPI...

EUVD-2024-51599

Malicious code in bioql PyPI...

EUVD-2025-18946

Malicious code in bioql PyPI...

CVE-2025-49977

Cross-Site Request Forgery CSRF vulnerability in mylacventures WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through = 2.3.4...