Stored Cross-Site Scripting in InvoicePlane by InvoicePlane Team
CVE-2026-26270

5.4MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
18 February 2026

What is CVE-2026-26270?

A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane, a self-hosted application for invoice management. This flaw permits an authenticated user, with rights to manage Invoice Groups, to inject harmful JavaScript code into the 'Identifier Format' field. The malicious script executes whenever a user accesses the invoice list or the main dashboard, posing significant risks of unauthorized data access and potential exploitation. The vulnerability is resolved in version 1.7.1.

Affected Version(s)

InvoicePlane = 1.7.0

References

https://github.com/InvoicePlane/InvoicePlane/security/adv...
x_refsource_CONFIRM
https://github.com/InvoicePlane/InvoicePlane/commit/93622...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.