CVE-2026-25596 - InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

Back Back to CVE browser

MEDIUM

InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

Published Feb 18, 2026

4.8

MEDIUM

CVSS 3.1

EPSS 0.27%

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any administrator views an invoice containing a product with the malicious unit. Version 1.7.1 patches the issue.

Affected products

Vendor InvoicePlane Product InvoicePlane Default
n/a
- Version
  <= 1.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

InvoicePlane

n/a

Version	Status	Constraints
<= 1.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8098
Advisory
https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6
x_refsource_MISCPatch
https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-3wjq-822q-98f4
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8098		Advisory
https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6		x_refsource_MISCPatch
https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-3wjq-822q-98f4		x_refsource_CONFIRMExploitVendor Advisory