Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
299 results · page 3 of 6
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.8
- What to do
- Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26281 · Other software · InvoicePlane · reported by GitHubMedium 4.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26270 · Other software · InvoicePlane · reported by GitHubMedium 5.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field. This script executes when any user views the invoice list or the main dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25596 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any administrator views an invoice containing a product with the malicious unit. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25595 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25594 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML encoding inside the family dropdown on the product form. When an administrator creates a family with a malicious name, the payload executes in the browser of any administrator who visits the product form. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25548 · Other software · InvoicePlane · reported by GitHubCritical 9.1
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the `public_invoice_template` setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24745 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24744 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24743 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24746 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-23491 · Other software · InvoicePlane · reported by GitHubCritical 9.3
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-1906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI endpoint identifiers (`peppol_endpoint_id`, `peppol_endpoint_eas`) for any customer by specifying an arbitrary `order_id` parameter on systems using Peppol invoicing. This can affect order routing on the Peppol network and may result in payment disruptions and data leakage.
- Product
- PDF Invoices & Packing Slips for WooCommerce
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2026A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web sCVE-2025-70095 · Other software · Opensourcepos · reported by MITREMedium 6.5
A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Invoct – PDF Invoices & Billing for WooCommerce: Unauthorized access of dataCVE-2026-1748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve invoice clients, invoice items, and list of WordPress users along with their emails.
- Product
- Invoct – PDF Invoices & Billing for WooCommerce
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Invoct – PDF Invoices & Billing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2026Link Invoice Payment for WooCommerce: Unauthorized modification of dataCVE-2025-14971 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration.
- Product
- Link Invoice Payment for WooCommerce
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Link Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2026Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules.CVE-2021-47769 · Other software · Bdtask · reported by VulnCheckMedium 5.1
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
- Product
- Isshue Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbdtask.comexploit-db.com
Jan 15, 2026File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executCVE-2025-67084 · Other software · Invoiceplane · reported by MITRECritical 9.9
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server.CVE-2025-67083 · Other software · Invoiceplane · reported by MITREMedium 5.3
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report.CVE-2025-67082 · Other software · Invoiceplane · reported by MITREMedium 6.5
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted scriptCVE-2025-56424 · Other software · Insiders-technologies · reported by MITREHigh 7.5
An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted script
- Product
- E-invoice Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsiders-technologies.commind-bytes.de
Jan 7, 2026A security vulnerability has been detected in invoiceninja up to 5.12.38.CVE-2026-0649 · Other software · reported by VulDBLow 2
A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Jan 7, 2026QR Code for WooCommerce order emails, PDF invoices, packing slips: Stored Cross-Site ScriptingCVE-2025-14626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- QR Code for WooCommerce order emails, PDF invoices, packing slips
- Affected
- up to 1.9.42
- What to do
- Affects up to 1.9.42. Update QR Code for WooCommerce order emails, PDF invoices, packing slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator CVE-2025-59467 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Products: UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier) Mitigation: Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.
- Product
- UCRM Argentina AFIP invoices Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025E-Invoice App Malaysia: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.
- Product
- E-Invoice App Malaysia
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update E-Invoice App Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Print Invoice & Delivery Notes for WooCommerce: Remote Code ExecutionCVE-2025-13773 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Easy Invoice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-6324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affects Easy Invoice: from n/a through <= 2.0.9.
- Product
- Easy Invoice
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
- Product
- PDF Invoice Builder for WooCommerce
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025InvoicePlane commit debb446c is vulnerable to Incorrect Access Control.CVE-2025-64012 · Other software · Invoiceplane · reported by MITREMedium 4.3
InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 9, 2025WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2025-67589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Easy Invoice: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-66115 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.
- Product
- Easy Invoice
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025WooCommerce PDF Invoice Builder: Missing AuthorizationCVE-2025-64269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.150
- What to do
- Affects up to 1.2.150. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-64229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2025Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages.CVE-2025-60378 · Other software · Fairsketch · reported by MITREHigh 8.1
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
- Product
- Rise Ultimate Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025Flexible PDF Invoices for WooCommerce &: Cross-Site Request Forgery (CSRF)CVE-2025-57977 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.
- Product
- Flexible PDF Invoices for WooCommerce &
- Affected
- up to 6.0.13
- What to do
- Affects up to 6.0.13. Update Flexible PDF Invoices for WooCommerce & to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary coCVE-2025-10009 · Other software · Invoice Ninja · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 8.6
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.
- Product
- Invoice Ninja 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module.CVE-2025-55580 · Other software · Solidinvoice · reported by MITREMedium 5.4
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsolidinvoice.co
Aug 29, 2025SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality.CVE-2025-55579 · Other software · Solidinvoice · reported by MITREMedium 5.4
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3.8.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsolidinvoice.co
Aug 26, 2025Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged aCVE-2025-8700 · Other software · Invoice Ninja · reported by cvd@cert.plMedium 4.8
Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access (e.g. via a malicious application) to attach a debugger, read or modify the process memory, inject code in the application's context despite being signed with Hardened Runtime and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission. According to Apple documentation, when a non-root user runs an app with the debugging tool entitlement, the system presents an authorization dialog asking for a system administrator's credentials. Since there is no prompt when the target process has "get-task-allow" entitlement, the presence of this entitlement was decided to be treated as a vulnerability because it removes one step needed to perform an attack. This issue was fixed in version 5.0.175
- Product
- Invoice Ninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plinvoiceninja.com
Aug 19, 2025A security flaw has been discovered in SolidInvoice up to 2.4.0.CVE-2025-9171 · Other software · Solidinvoice · reported by VulDBLow 2
A security flaw has been discovered in SolidInvoice up to 2.4.0. The impacted element is an unknown function of the file /clients of the component Clients Module. Performing manipulation of the argument Name results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was identified in SolidInvoice up to 2.4.0.CVE-2025-9170 · Other software · Solidinvoice · reported by VulDBLow 2
A vulnerability was identified in SolidInvoice up to 2.4.0. The affected element is an unknown function of the file /tax/rates of the component Tax Rates Module. Such manipulation of the argument Name leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was determined in SolidInvoice up to 2.4.0.CVE-2025-9169 · Other software · Solidinvoice · reported by VulDBLow 2
A vulnerability was determined in SolidInvoice up to 2.4.0. Impacted is an unknown function of the file /quotes of the component Quote Module. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was found in SolidInvoice up to 2.4.0.CVE-2025-9168 · Other software · Solidinvoice · reported by VulDBLow 2
A vulnerability was found in SolidInvoice up to 2.4.0. This issue affects some unknown processing of the file /invoice of the component Invoice Creation Module. The manipulation of the argument Client Name results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability has been found in SolidInvoice up to 2.4.0.CVE-2025-9167 · Other software · Solidinvoice · reported by VulDBLow 2
A vulnerability has been found in SolidInvoice up to 2.4.0. This vulnerability affects unknown code of the file /invoice/recurring of the component Recurring Invoice Module. The manipulation of the argument client name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection.CVE-2025-42934 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed (LF) characters into application inputs. This vulnerability has a low impact on the application's integrity and no impact on confidentiality or availability.
- Product
- SAP S/4HANA (Supplier invoice)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025WooCommerce PDF Invoice Builder: Cross-Site Request Forgery (CSRF)CVE-2025-53203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.148.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.148
- What to do
- Affects up to 1.2.148. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Print Invoice & Delivery Notes for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-49239 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 5.3.8.
- Product
- PDF Invoice Builder for WooCommerce
- Affected
- up to 5.3.8
- What to do
- Affects up to 5.3.8. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attacksCVE-2025-1981 · Other software · Symfonia · reported by cvd@cert.plCritical 9.4
Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attacks.
- Product
- Ready_
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.