CVE-2023-1806: 
WordPress vulnerability analysis and mitigation

The WP Inventory Manager WordPress plugin versions before 2.1.0.12 contain a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-1806. The vulnerability exists because the plugin does not properly sanitize and escape the message parameter before outputting it back in the page, which could potentially be exploited against high-privilege users such as administrators (WPScan).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS score of 7.5 (high) and is mapped to CWE-79. The issue occurs on pages where the [wpinventory] shortcode is embedded. An attacker can exploit this by appending malicious JavaScript code to the message parameter in the URL (WPScan).

This vulnerability could allow attackers to execute arbitrary JavaScript code in the context of high-privilege users' browsers, potentially leading to account compromise or unauthorized actions being performed on behalf of the administrator (WPScan).

The vulnerability has been fixed in version 2.1.0.12 of the WP Inventory Manager plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).