The PlainInventory WordPress plugin contains an improper neutralization of input during page generation that permits attackers to inject malicious script into a page served to a user. The flaw is reflected – the attacker’s input is returned unencoded by the plugin, so a crafted URL or form can execute arbitrary JavaScript in the victim’s browser, facilitating session theft, phishing or other client‑side compromise, and thus impacting confidentiality and integrity of the victim’s session. This is a classic CWE‑79 issue.

PlainInventory (plainware z‑inventory‑manager) versions up to and including 3.1.5 are vulnerable. Any WordPress site using any release numbered 3.1.5 or earlier, without applying a later patch, is affected.

The CVSS score of 7.1 indicates a moderate‑to‑high severity that can be exploited by anyone who can persuade a victim to visit a crafted link or submit a malicious form. The EPSS score of less than 1% shows that exploitation is unlikely at present, yet the vulnerability remains present and is not included in CISA KEV, so no public exploits are widely known. The attack vector is purely web‑based; no authentication or elevated privileges are required beyond normal usage. Site operators should consider that compromised users could be leveraged for further phishing or credential theft.