CVE-2026-42645
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Barcode Scanner with Inventory & Order Manager plugin (barcode-scanner-lite-pos-to-manage-products-inventory-and-orders) by Dmitry V. contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions up to and including 1.11.0.
Risk Assessment
An attacker can trick a logged-in administrator into performing unintended actions in the application, potentially leading to data or configuration modification.
Recommendation
Update the plugin to a version newer than 1.11.0 if available, or implement additional CSRF protections (e.g., tokens) and restrict access to the admin panel.
Other vulnerabilities in Barcode Scanner with Inventory & Order Manager
See all- CVE-2026-62118High
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 has a broken access control flaw exploitable by an unauthenticated attacker. This allows access to functions or data that should be protected.
- CVE-2026-62117High
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 is vulnerable to SQL injection exploitable by a subscriber-level user. The flaw allows manipulation of database queries.
- CVE-2026-62116High
The Barcode Scanner with Inventory & Order Manager plugin in versions up to and including 1.13.1 contains a Cross Site Scripting (XSS) flaw exploitable by an unauthenticated attacker. This allows injection of malicious script into site pages.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.11.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS