The Squirrels Auto Inventory plugin for WordPress contains a stored XSS flaw in administration settings across all versions up to 1.0.3. When an authenticated user with administrator privileges or higher alters these settings, unsanitized input can be stored and later rendered within pages. The stored script executes in the browsers of any user who views an affected page, allowing the attacker to steal cookies, hijack sessions, or inject malicious content without the user’s knowledge.

The vulnerability affects installations of the Squirrels Auto Inventory plugin, version 1.0.3 and earlier, on multi‑site WordPress environments where the unfiltered_html feature is disabled. All users who have the ability to access the plugin’s admin settings can exploit the flaw, and the impact is realized on other site visitors who view pages containing the injected content.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation as of the latest data. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires administrator credentials, so the the attack surface is limited to privileged users. Once the stored payload is present, however, it can affect any visitor to the injected page.