Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-09
Wp Inventory Manager - Security Vulnerability (CVE-2026-111403)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.
PLUGIN
Wp Inventory Manager
CVE-2026-111403
Risk Score
Threat Entry
Updated 2026-09-18
Wp Inventory Manager - Security Vulnerability (CVE-2026-17607)
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the WPIMItem::get_all() function — parse_custom_where() only performs html_entity_decode(), strips semicolons, and does field-label name replacements, without using $wpdb->prepare() or a whitelist. The resulting string is concatenated into a raw SELECT statement that is executed via $wpdb->get_results(). This makes it possible for…
PLUGIN
Wp Inventory Manager
CVE-2026-17607
Risk Score
Threat Entry
Updated 2026-09-17
Wp Inventory Manager - Security Vulnerability (CVE-2026-90887)
Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager
PLUGIN
Wp Inventory Manager
CVE-2026-90887
Risk Score
Threat Entry
Updated 2026-07-13
Wp Inventory Manager - SQL Injection (CVE-2026-57772)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through
PLUGIN
Wp Inventory Manager
CVE-2026-57772
Risk Score
Threat Entry
Updated 2026-06-17
Wp Inventory Manager - Cross-Site Request Forgery (CSRF) (CVE-2025-49977)
Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through
PLUGIN
Wp Inventory Manager
CVE-2025-49977
Risk Score
Threat Entry
Updated 2026-06-17
WP Inventory Manager - Cross-Site Scripting (XSS) (CVE-2024-13434)
The WP Inventory Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
WP Inventory Manager
CVE-2024-13434
Risk Score
Threat Entry
Updated 2026-06-17
WP Inventory Manager plugin - Cross-Site Request Forgery (CSRF) (CVE-2023-34002)
Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin
PLUGIN
WP Inventory Manager plugin
CVE-2023-34002
Risk Score
Threat Entry
Updated 2026-06-17
Wp Inventory Manager - Cross-Site Scripting (XSS) (CVE-2023-2123)
The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
PLUGIN
Wp Inventory Manager
CVE-2023-2123
Risk Score
Threat Entry
Updated 2026-06-17
Wp Inventory Manager - Cross-Site Request Forgery (CSRF) (CVE-2023-2842)
The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack
PLUGIN
Wp Inventory Manager
CVE-2023-2842
Risk Score
Threat Entry
Updated 2026-06-17
WP Inventory Manager - Cross-Site Scripting (XSS) (CVE-2023-1806)
The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
PLUGIN
WP Inventory Manager
CVE-2023-1806
Risk Score