CVE-2023-2579 | BDVDB-2026-207449 Detail

InventoryPress

Description#

The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe
https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin

Exploit#

https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe

History#

Version 12023-07-17Record published in the CVE List.
Version 22024-10-30Most recent update recorded in the CVE List.