an unauthenticated Cross Site Scripting flaw present in WordPress Barcode Scanner with Inventory & Order Manager plugin versions up to 1.13.1. The flaw enables an attacker to inject and execute arbitrary JavaScript within the context of any user who visits the affected plugin pages, potentially allowing session cookie theft, credential hijacking, defacement, or redirection to malicious sites. The weakness is identified as CWE‑79, reflecting insufficient validation or sanitization of untrusted input.

The plugin author, Dmitry V., identified the affected product as the WordPress Barcode Scanner with Inventory & Order Manager plugin. Versions 1.13.1 and earlier of this plugin are vulnerable, so any WordPress installation running one of those releases is at risk.

The CVSS score of 7.1 classifies this flaw as High severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation reports yet. Nonetheless, the flaw is unauthenticated, meaning an attacker only needs to craft a malicious request or URL and persuade a user to access it. The impact can range from user‑level data theft to full site compromise if an administrator is affected. The lack of a known exploit does not reduce the threat, given the wide availability of the vulnerability and its severe potential consequences.