CVE-2026-90887
HighCVSS 7.1Summary
An unauthenticated Cross-Site Scripting (XSS) vulnerability in WP Inventory Manager versions ≤ 2.5.4 allows attackers to execute scripts in the victim's browser without authentication.
Risk Assessment
Risk of session hijacking or performing unauthorized actions in the context of a logged-in user.
Recommendation
Update the plugin to a patched version. Validate input data.
Other vulnerabilities in WP Inventory Manager
See all- CVE-2026-17607Medium
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to and including 2.5.1. This is due to insufficient escaping and lack of prepared statements in the WPIMItem::get_all() function. Authenticated attackers with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-57772High
The WP Inventory Manager plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions up to and including 2.4.0.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.