Is CVE-2026-111403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111403 being exploited in the wild.

How severe is CVE-2026-111403?

High severity, with a CVSS score of 7.1, published 9 November 2026.

Which products and versions are affected?

WP Inventory Manager through 2.5.9.

Is there a fix for CVE-2026-111403?

Yes: fixed in 2.5.10. Until then: Patchstack has issued a WAF mitigation rule to block attacks until you can update to version 2.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111403 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111403?

Check whether you run WP Inventory Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111403: WP Inventory Manager reflected XSS in plugin

CVE-2026-111403 · Severity: high · CVSS 7.1 · Published 2026-11-09

WP Inventory Manager is a WordPress plugin for managing product inventory on websites. An attacker can inject malicious scripts into unprotected input fields that get reflected back to users, allowing them to steal visitor data or hijack accounts without requiring the victim to be logged in.

Technologies: WP Inventory Manager. Vendors: WP Inventory.

Quick answers

Is CVE-2026-111403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111403 being exploited in the wild.
How severe is CVE-2026-111403?: High severity, with a CVSS score of 7.1, published 9 November 2026.
Which products and versions are affected?: WP Inventory Manager through 2.5.9.
Is there a fix for CVE-2026-111403?: Yes: fixed in 2.5.10. Until then: Patchstack has issued a WAF mitigation rule to block attacks until you can update to version 2.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111403 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111403?: Check whether you run WP Inventory Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5.10

Patchstack has issued a WAF mitigation rule to block attacks until you can update to version 2.5.10 or later.

Technical details

Improper neutralization of user input during web page generation allows reflected cross-site scripting (XSS). The plugin fails to sanitize query parameters or form inputs before rendering them back in the HTML response. An unauthenticated attacker can craft a malicious link and send it to site visitors; when clicked, the injected script executes in their browser with access to their session and sensitive data.

Affected products

WP Inventory WP Inventory Manager through 2.5.9

Timeline

2026-11-09: disclosed
2026-10-13: other: reported to vendor

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.