Stored Cross-Site Scripting Vulnerability in InvoicePlane by InvoicePlane Inc.
CVE-2026-26281

4.4MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
18 February 2026

What is CVE-2026-26281?

InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments, has a stored cross-site scripting (XSS) vulnerability in the Sumex invoice view. This flaw permits an authenticated user with proper client and invoice management privileges to inject arbitrary JavaScript code into invoices. When other users access these invoices, the embedded scripts can execute in their browsers, potentially leading to session hijacking, unauthorized data access, or other malicious activities. The vulnerability was addressed in version 1.7.1.

Affected Version(s)

InvoicePlane = 1.7.0

References

https://github.com/InvoicePlane/InvoicePlane/security/adv...
x_refsource_CONFIRM
https://github.com/InvoicePlane/InvoicePlane/commit/93622...
x_refsource_MISC

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.