Stored Cross-Site Scripting Vulnerability in InvoicePlane by InvoicePlane

CVE-2026-25596

What is CVE-2026-25596?

InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments, is exposed to a stored Cross-Site Scripting (XSS) vulnerability. This issue arises in version 1.7.0 through the Product Unit Name fields. An authenticated administrator has the capability to inject harmful JavaScript into these fields, leading to script execution whenever another administrator views an invoice containing the compromised product. This can result in unauthorized actions being taken under the guise of legitimate administrative activity. The vulnerability has been addressed in version 1.7.1, which mitigates the risk by sanitizing user input effectively.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References