CVE-2023-2842

CVE-2023-2842 affects the WordPress plugin WP Inventory Manager (pre-2.1.0.14). The vulnerability stems from missing CSRF checks, enabling a CSRF attack to cause logged-in admins to delete Inventory Items. Remediation: upgrade to version 2.1.0.14 or later. Reported impact aligns with CVSS v3.1: a...

CVE-2023-2123

CVE-2023-2123 affects the WordPress plugin WP Inventory Manager prior to version 2.1.0.13. The issue is an insufficient sanitization/escaping of a parameter before it is echoed on the page, causing a Reflected Cross-Site Scripting (XSS) . Impact is limited to unauthenticated users triggering XSS ...

CVE-2023-1806

CVE-2023-1806 affects the WP Inventory Manager WordPress plugin prior to version 2.1.0.12. The issue is a Reflected XSS caused by insufficient sanitisation/escaping of the message parameter before output to the page, potentially exploitable against high-privilege users (e.g., administrators). Roo...

CVE-2023-34002

CVE-2023-34002 is a CSRF vulnerability in the WP Inventory Manager WordPress plugin up to version 2.1.0.13. Exploitation details in the connected records indicate Cross-Site Request Forgery via actions like delete_item, with unauthenticated attacker impact potential, and a high CVSS-like score de...