WordPress Plugin Vulnerabilities

InventoryPress <= 1.7 - Author+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
inventorypress
No known fix

References

CVE
CVE-2023-2579
URL
https://github.com/daniloalbuqrque/poc-cve-xss-inventory-press-plugin

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
daniloalbuqrque
Submitter
daniloalbuqrque
Submitter website
https://github.com/daniloalbuqrque
Verified
Yes
WPVDB ID
3cfcb8cc-9c4f-409c-934f-9f3f043de6fe

Timeline

Publicly Published
2023-06-23 (about 2 years ago)
Added
2023-06-23 (about 2 years ago)
Last Updated
2023-06-23 (about 2 years ago)

Other

Published
Title
Published
2025-12-11
Title
WP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2025-12-05
Title
Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2023-11-29
Title
Parallax Slider Block < 1.2.6 - Author+ Stored XSS
Published
2025-01-08
Title
Deliver via Shipos for WooCommerce < 2.2.0 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter
Published
2025-01-24
Title
ElementInvader Addons for Elementor < 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting