WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

2023-04-2600:00:00

daniloalbuqrque

wordpress

inventory manager

cross-site scripting

frontend

url parameters

exploit

0.0005 Low

EPSS

Percentile

17.1%

JSON

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

1. Go to WP Inventory > Inventory Items and create a new Inventory Item.
2. Create a page and add the [wpinventory] shortcode.
3. View the new page on the frontend, and click on the new Inventory Item.
3. Add the URL parameters: display=false&message=%3Cscript%3Ealert(/xss/)%3C/script%3E, and load the page.