Pnn219

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.

A cross-site request forgery issue exists where the '/admin/product/combinations/update' and '/admin/product/default-price/update' endpoints accept GET requests without verifying anti-CSRF tokens. This allows an attacker to trick an authenticated administrator into clicking a malicious link to modify product combination details, including prices, stock, weight, EAN, and sale flags, potentially resetting omitted prices to zero.

A stored cross-site scripting issue exists where authenticated back-office administrators with store update permissions can inject scripts. This occurs by uploading unsanitized SVG images via the `logo file` or `banner file` variables. The malicious scripts, using an onload payload, are served from the '/admin/store-media/logo' endpoint or the 'public cache/images/store/' directory, allowing execution against visitors and higher-privileged administrators.

A stored cross-site scripting issue exists in the `getSummary()` function of the `ForSomeCustomers` class. Unauthenticated attackers can inject malicious scripts through unescaped customer names. By registering with a script payload as their name, the script executes when administrators view related coupons, potentially allowing the theft of CSRF (Cross-Site Request Forgery) tokens—a technique used to impersonate a user—to create unauthorized administrator accounts.

A cross-site request forgery issue exists in the back office where per-session CSRF tokens leak through URL query strings. This allows attackers to forge administrative actions by reusing leaked tokens or targeting the unprotected `setToggleVisibilityAction()` and `updatePositionAction()` functions. Consequently, authenticated administrators may be tricked into deleting, hiding, or reordering configuration and catalogue objects.

A cross-site request forgery (CSRF) issue exists where remote attackers can delete page tags, documents, and images. This occurs because back-office delete routes lack CSRF tokens—unique identifiers used to prevent unauthorized requests—and permission checks. Attackers can trick a logged-in administrator into clicking crafted GET requests that iterate through sequential IDs to remove TheliaLibrary images, including their associated files and variants, across pages, products, and categories.

An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication.

An uncontrolled resource consumption issue exists within the Automatic Persisted Query handler. Unauthenticated attackers can persist unlimited query documents by sending distinct queries that share matching SHA-256 `queryId` values, including batched operations. This process causes the `wp posts` table to grow without bound, leading to degraded database performance.

An information disclosure issue allows unauthenticated attackers to determine if specific objects exist by analyzing distinct error responses. By iterating IDs against the `deleteMediaItem`, `updateMediaItem`, `deleteComment`, and `updateComment` mutations, attackers can discover hidden drafts, private or trashed posts, custom post types, and unapproved comments.

An issue exists where missing rate limiting allows unauthenticated attackers to flood password reset emails. This is achieved by aliasing the `sendPasswordResetEmail` mutation, enabling an attacker to send a single HTTP request containing multiple aliases. This technique bypasses the `batch limit`, which can exhaust the mail provider quota and cause repeated rotation of reset keys, effectively blocking legitimate password recovery processes.

An authorization flaw exists in the `createComment` mutation. This allows unauthenticated users to bypass post status checks and add comments to non-public posts, including those that are draft, private, trashed, or password-protected. This can lead to the enumeration of post IDs, the leaking of hidden titles through moderator notifications, and the ability to backdate comments or mark them as pingbacks.

Stored cross-site scripting occurs due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access and above can inject arbitrary web scripts via the `base-url` attribute of the `[mpg]` and `[mpg match]` shortcodes. Attackers can use entity-encoded payloads that bypass kses (a WordPress function used to sanitize HTML) but are subsequently decoded by `html entity decode()` and rendered unescaped through `{{mpg url}}`, leading to script execution in the browsers of administrators.

A missing authorization check in the `update fees` AJAX handler allows unauthenticated attackers to read and modify orders belonging to other customers. By reusing a nonce from their own order-pay page and providing sequential `order id` values, attackers can change payment methods, recalculate fees, and disclose order totals and line items.