WP Inventory Manager EUVD-2026-81521

Reflected XSS requiring user interaction (UI:R): a victim must open an attacker-crafted URL or visit a page containing the malicious payload against a site running WP Inventory Manager ≤2.5.4. No authentication is required (PR:N), and it works against default configurations, but exploitation depends on successfully luring a target to click/render the crafted request; the specific vulnerable parameter/endpoint is not named in the provided description. Impact is bounded by the victim's browser session and privileges - highest value when an authenticated administrator is targeted.

This is an unauthenticated Cross-Site Scripting flaw (CWE-79) in the WP Inventory Manager WordPress plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) yields 7.1, driven largely by the scope change (S:C) typical of reflected XSS escaping the plugin's context into the wider page/browser. All key threat-intel signals are absent: no EPSS score, no CISA KEV listing, and no public POC referenced (only the Patchstack advisory). Exploitation status is therefore 'no public exploit identified at time of analysis.' The vector requires UI:R - a victim must click a crafted link or visit an attacker-controlled page - which materially lowers real-world weaponizability compared to a no-interaction bug. The vendor's inclusion of A:L (availability impact) is atypical for reflected XSS, which normally has no availability effect; I assess A:N and a corrected score near 6.1. Net: a legitimate but medium-tier issue - real enough to patch, but not a drop-everything priority absent evidence of exploitation and given the niche footprint of the affected plugin.

An attacker crafts a URL for a WP Inventory Manager page containing a malicious script payload in a reflected parameter and lures a visitor or logged-in admin to click it (e.g. via phishing or a malicious link). When the page renders the unescaped input, the script executes in the victim's browser session, allowing session/cookie theft, admin-action forgery, or content injection. No public POC is referenced in the available data, and user interaction (a click/visit) is required.