CVE-2026-65510
HighCVSS 7.1Summary
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.
Risk Assessment
The risk involves the possibility of executing a malicious script in the victim's browser, potentially leading to session theft, redirects, or data theft.
Recommendation
It is recommended to update the PeproDev Ultimate Invoice plugin to a version above 2.2.6 that fixes the XSS vulnerability.
Other vulnerabilities in PeproDev Ultimate Invoice
See all- CVE-2026-65516High
The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.
- CVE-2026-65499Medium
The PeproDev Ultimate Invoice plugin versions 2.2.6 and earlier have an unauthenticated broken access control vulnerability. Unauthenticated users can gain unauthorized access to functions or data.
- CVE-2026-27372Medium
The PeproDev Ultimate Invoice plugin for WordPress versions 2.2.6 and earlier contains an unauthenticated sensitive data exposure vulnerability.
- CVE-2024-32518Medium
The PeproDev Ultimate Invoice WordPress plugin (by Pepro Dev. Group) up to version 2.0.0 has a missing authorization vulnerability that could allow unauthorized users to perform certain operations.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.