CVE-2025-50012

WordPress Inventory Presser plugin <= 15.2.6 - Cross Site Scripting (XSS) vulnerability

Published Jun 20, 2025 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through <= 15.2.6.

Analysis

Technical impact

The Inventory Presser plugin for WordPress contains a stored XSS flaw that allows an attacker to inject malicious scripts into pages displayed to other users. This can lead to theft of session cookies, credential leakage, or impersonation of legitimate users. The weakness arises from improperly neutralizing user-supplied input before rendering it, classified as a Cross-site Scripting (CWE-79) issue.

Affected Systems

WordPress sites running the fridaysystems Inventory Presser plugin version 15.2.6 or earlier.

Risk and Exploitability

The CVSS base score of 5.9 indicates moderate risk. The EPSS score of <1 % suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the stored XSS nature, an attacker would need the ability to submit or edit content via the plugin front-end or back-end, which often requires administrative or plugin-author privileges. After compromising a user’s browser, the attacker could execute arbitrary client-side code.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

fridaysystems

Inventory Presser

unaffected

Version	Status	Constraints
`0`	affected	≤ 15.2.6

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Inventory Presser plugin to the latest available version (≥15.2.7) to remove the stored XSS flaw.
If an update is not immediately possible, disable the plugin on all affected sites or delete any data that may contain injected scripts until a proper fix is applied.
Run a comprehensive scan of all WordPress installations for injected scripts or unexpected JavaScript in pages served by the plugin, and remove any malicious content discovered.

Generated by OpenCVE AI on April 30, 2026 at 10:50 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-28350	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser allows Stored XSS. This issue affects Inventory Presser: from n/a through 15.0.0.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.256% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/inventory-presser/vulnerability/wordpress-inventory-presser-plugin-15-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser allows Stored XSS. This issue affects Inventory Presser: from n/a through 15.0.0.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through <= 15.2.6.
Title	WordPress Inventory Presser plugin <= 15.0.0 - Cross Site Scripting (XSS) Vulnerability	WordPress Inventory Presser plugin <= 15.2.6 - Cross Site Scripting (XSS) vulnerability
References	https://patchstack.com/database/wordpress/plugin/inventory-presser/vulnerability/wordpress-inventory-presser-plugin-15-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/inventory-presser/vulnerability/wordpress-inventory-presser-plugin-15-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}`

Jun 23, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 20, 2025 3:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser allows Stored XSS. This issue affects Inventory Presser: from n/a through 15.0.0.
Title		WordPress Inventory Presser plugin <= 15.0.0 - Cross Site Scripting (XSS) Vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/inventory-presser/vulnerability/wordpress-inventory-presser-plugin-15-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}`