CVE-2026-111403: WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vector is network-based, no attacker privileges are required, and exploitation requires user interaction. The available data does not specify the exact request or page used to trigger the reflected XSS.

Q: What is the potential impact if exploitation succeeds?

The issue is rated high with a CVSS score of 7.1. The supplied vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Q: Which plugin versions are affected?

WP Inventory Manager versions through 2.5.9 are affected. No fixed version is provided in the available data.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.

Affected Software

1 affected component

WP Inventory WP Inventory Manager<=2.5.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Inventory Manager to a version that resolves this vulnerability.
Fixed in 2.5.10

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vector is network-based, no attacker privileges are required, and exploitation requires user interaction. The available data does not specify the exact request or page used to trigger the reflected XSS.

What is the potential impact if exploitation succeeds?

The issue is rated high with a CVSS score of 7.1. The supplied vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Which plugin versions are affected?

WP Inventory Manager versions through 2.5.9 are affected. No fixed version is provided in the available data.

CVE-2026-111403: WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?