Stored Cross-Site Scripting Vulnerability in InvoicePlane Open-Source Application

CVE-2026-25594

What is CVE-2026-25594?

InvoicePlane, an open-source application designed for managing invoices, clients, and payments, is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability occurs in version 1.7.0 when the family_name field is not properly encoded for HTML when rendered in the family dropdown on the product form. This flaw allows an attacker to inject malicious scripts, which execute in the browser of any administrator who accesses this form. Administrators are urged to upgrade to InvoicePlane version 1.7.1, which addresses this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References