The GLPI Inventory Plugin manages network discovery, inventory, software deployment and data collection for GLPI agents. It contains a reflected XSS flaw in the task jobs page that exists before version 1.6.6. An attacker can inject malicious scripts into the URL or form fields associated with task jobs, causing the browser of anyone who views the page to execute arbitrary JavaScript. This vulnerability is cataloged as CWE‑79 and, while it does not grant direct code execution on the server, it can facilitate phishing, cookie theft or other client‑side attacks.

The flaw affects all releases of the GLPI Inventory Plugin older than 1.6.6. Versions 1.6.6 and newer contain the fix. The affected product is the glpi-project glpi-inventory-plugin, and the issue is documented by the GLPI project and disclosed on GitHub.

The CVSS score of 4.5 indicates moderate impact, and the EPSS score of less than 1% shows low exploitation probability as of the current data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted URL or form input that a victim visits or submits, which allows an attacker to inject JavaScript into the task jobs page. The flaw requires a victim to open the page; no privileged access is necessary, so it can be exploited via social engineering or phishing campaigns.