Cross Site Scripting Vulnerability in WP Inventory Manager by WordPress
CVE-2026-90887

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP Inventory Manager
Vendor
CVE Published:
17 September 2026

What is CVE-2026-90887?

The unauthenticated Cross Site Scripting (XSS) vulnerability in WP Inventory Manager allows attackers to inject malicious scripts into web pages viewed by users. This risk is present in all versions up to 2.5.4, potentially leading to unauthorized actions on behalf of a user or disclosure of sensitive information. Proper validation and sanitization of user input are essential to mitigate such vulnerabilities and enhance the overall security of the WordPress installation.

Affected Version(s)

WP Inventory Manager <= 2.5.4

References

https://patchstack.com/database/wordpress/plugin/wp-inven...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sorawautsukushiii | Patchstack Bug Bounty Program
.