Stored Cross-Site Scripting Vulnerability in InvoicePlane Open-Source Application
CVE-2026-25594

4.8MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
18 February 2026

What is CVE-2026-25594?

InvoicePlane, an open-source application designed for managing invoices, clients, and payments, is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability occurs in version 1.7.0 when the family_name field is not properly encoded for HTML when rendered in the family dropdown on the product form. This flaw allows an attacker to inject malicious scripts, which execute in the browser of any administrator who accesses this form. Administrators are urged to upgrade to InvoicePlane version 1.7.1, which addresses this issue.

Affected Version(s)

InvoicePlane <= 1.7.0

References

https://github.com/InvoicePlane/InvoicePlane/security/adv...
x_refsource_CONFIRM
https://github.com/InvoicePlane/InvoicePlane/commit/93622...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.