Barcode Scanner EUVD-2026-96504

Exploitation requires an attacker to deliver a crafted payload that a victim user must actively load or interact with (UI:R) - typically by clicking an attacker-supplied link or visiting an attacker-influenced page served by the vulnerable plugin, so it is not fully automatable drive-by exploitation. No authentication is required by the attacker (PR:N), and any site running Barcode Scanner with Inventory & Order Manager version 1.13.1 or earlier is affected. The primary limiting factors are the mandatory user interaction, the browser-context (rather than server-side) nature of the impact, and the plugin's limited deployment footprint; impact is magnified when the lured victim is an authenticated administrator.

This is CWE-79 Cross-Site Scripting in the WordPress plugin 'Barcode Scanner with Inventory & Order Manager' (<= 1.13.1), reported by Patchstack and carrying a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity, unauthenticated (PR:N) exploitation, but it critically requires user interaction (UI:R), meaning a victim must be lured into triggering the malicious payload - this is the single largest brake on real-world risk. The scope-changed flag (S:C) and the low C/I/A impacts are consistent with typical XSS: code executes in the victim's browser context rather than directly on the server. No EPSS score, KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (no CVSS-vs-description conflict), but the severity is driven by the 'unauthenticated' label; in practice the UI:R requirement plus the plugin's apparently small deployment footprint make this a moderate-priority patch rather than an urgent emergency. EPSS is absent, which prevents a data-driven exploitation-probability estimate.

An attacker crafts a URL or input containing a malicious script payload targeting a vulnerable parameter in the Barcode Scanner plugin and delivers it to a victim (e.g., an admin or store operator) via phishing or a planted link. When the victim loads the crafted page, the unsanitized payload executes in their browser session, enabling session/cookie theft or actions in the WordPress admin context. No public proof-of-concept was provided in the input.