An input‑validation flaw in the Scanventory WooCommerce inventory‑management plugin allows reflected cross‑site scripting (CWE‑79). When an attacker supplies malicious data, the plugin includes it directly in the generated HTML response without proper encoding, giving the attacker the ability to execute arbitrary JavaScript in a victim’s browser. This can lead to cookie theft, session hijacking, defacement or the execution of destructive commands if the victim is an administrator.

The vulnerability affects the Scanventory plugin from intelligence_lab for WordPress, with affected releases up through version 1.1.3. Any WordPress site that has Scanventory 1.1.3 or older installed is potentially impacted.

The vulnerability is scored with a CVSS of 7.1, indicating high severity, but its EPSS score of less than 1% suggests low likelihood of exploitation so far. It is not listed in the CISA KEV catalog. The attack can be performed by an attacker who can send a crafted HTTP request to an affected WordPress site; the malicious payload is reflected in the response, requiring an authenticated or unauthenticated web user to view the injected script. The plausible route is a simple URL alteration or form submission that emits the supplied value back to the browser.