This vulnerability (CVE-2026-90887) involves improper neutralization of input during web page generation in WP Inventory Manager, leading to an unauthenticated Cross-Site Scripting (XSS) issue. It affects versions up to and including 2.5.4. The CVSS 3.1 score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available in the provided data.

Successful exploitation can allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected application and monitoring for suspicious activity related to XSS attacks. Avoid relying on generic mitigations unless specifically recommended by the vendor.