Stored Cross-Site Scripting Vulnerability in Squirrels Auto Inventory Plugin for WordPress

CVE-2025-12631

What is CVE-2025-12631?

The Squirrels Auto Inventory plugin for WordPress contains a vulnerability that allows authenticated attackers with admin-level permissions to exploit insufficient input sanitization and output escaping mechanisms. This flaw enables the injection of arbitrary web scripts into admin settings, affecting multi-site installations and installations where the unfiltered_html option is disabled. When users access compromised pages, the injected scripts can execute, posing a significant security risk.

References