Skip to content
Sign in
6.1 Medium

CVE-2023-1806 The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before…

Description

The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.

Affected products and versions

Product Affected versions Fixed in
WP Inventory Manager 2.1 earliest → < 2.1.0.12 2.1.0.12

Other CVEs of WP Inventory Manager

The 3 CVEs of WP Inventory Manager →
CVE-2023-2123 The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting… Not rated CVE-2023-2842 The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make… Not rated
Track this CVE