WP Inventory Manager vulnerabilities

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to and including 2.5.1. This is due to insufficient escaping and lack of prepared statements in the WPIMItem::get_all() function. Authenticated attackers with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.

An unauthenticated Cross-Site Scripting (XSS) vulnerability in WP Inventory Manager versions ≤ 2.5.4 allows attackers to execute scripts in the victim's browser without authentication.

The WP Inventory Manager plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions up to and including 2.4.0.