Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,047 results · page 4 of 21
Feb 26, 2026Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endCVE-2026-2679 · Other software · A3factura · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.
- Product
- A3factura
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function.CVE-2026-26746 · Other software · Opensourcepos · reported by MITREHigh 8.8
OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-24946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.8
- What to do
- Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26281 · Other software · InvoicePlane · reported by GitHubMedium 4.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26270 · Other software · InvoicePlane · reported by GitHubMedium 5.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field. This script executes when any user views the invoice list or the main dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25596 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any administrator views an invoice containing a product with the malicious unit. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25595 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25594 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML encoding inside the family dropdown on the product form. When an administrator creates a family with a malicious name, the payload executes in the browser of any administrator who visits the product form. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25548 · Other software · InvoicePlane · reported by GitHubCritical 9.1
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the `public_invoice_template` setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24745 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24744 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24743 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24746 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-23491 · Other software · InvoicePlane · reported by GitHubCritical 9.3
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attacker could cause a codCVE-2025-33249 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA NeMo Framework for all platforms contains a vulnerability in a voice-preprocessing script, where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Feb 18, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-1906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI endpoint identifiers (`peppol_endpoint_id`, `peppol_endpoint_eas`) for any customer by specifying an arbitrary `order_id` parameter on systems using Peppol invoicing. This can affect order routing on the Peppol network and may result in payment disruptions and data leakage.
- Product
- PDF Invoices & Packing Slips for WooCommerce
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026Easy Voice Mail: Stored Cross-Site ScriptingCVE-2026-1164 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Voice Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Voice Mail
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Easy Voice Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2026A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web sCVE-2025-70095 · Other software · Opensourcepos · reported by MITREMedium 6.5
A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Invoct – PDF Invoices & Billing for WooCommerce: Unauthorized access of dataCVE-2026-1748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve invoice clients, invoice items, and list of WordPress users along with their emails.
- Product
- Invoct – PDF Invoices & Billing for WooCommerce
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Invoct – PDF Invoices & Billing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2026Link Invoice Payment for WooCommerce: Unauthorized modification of dataCVE-2025-14971 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration.
- Product
- Link Invoice Payment for WooCommerce
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Link Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-AudCVE-2026-23764 · Other software · VB-Audio Software · reported by VulnCheckMedium 6.8
VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems.
- Product
- Voicemeeter (Standard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vb-audio.comforum.vb-audio.com
Jan 22, 2026VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-AudCVE-2026-23762 · Other software · VB-Audio Software · reported by VulnCheckMedium 6.9
VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers map non-paged pool memory into user space via MmMapLockedPagesSpecifyCache using UserMode access without proper exception handling. If the mapping fails, such as when a process has exhausted available virtual address space, MmMapLockedPagesSpecifyCache raises an exception that is not caught, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems.
- Product
- Voicemeeter (Standard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vb-audio.comforum.vb-audio.com
Jan 22, 2026VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-AudCVE-2026-23761 · Other software · VB-Audio Software · reported by VulnCheckMedium 6.9
VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). When a handle is opened with a special file attribute value, the drivers improperly initialize FILE_OBJECT->FsContext to a non-pointer magic value. If subsequent operations are not handled by the VB-Audio driver and are forwarded down the audio driver stack (e.g., via PortCls to ks.sys), the invalid FsContext value can be dereferenced, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_ACCESS_VIOLATION. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems.
- Product
- Voicemeeter (Standard)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vb-audio.comforum.vb-audio.com
Jan 15, 2026A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacCVE-2025-67822 · Email & office · Mitel · reported by MITRECritical 9.4
A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gain unauthorized access to user or admin accounts in the system.
- Product
- Mivoice Mx-one
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules.CVE-2021-47769 · Other software · Bdtask · reported by VulnCheckMedium 5.1
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
- Product
- Isshue Shopping Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbdtask.comexploit-db.com
Jan 15, 2026File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executCVE-2025-67084 · Other software · Invoiceplane · reported by MITRECritical 9.9
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server.CVE-2025-67083 · Other software · Invoiceplane · reported by MITREMedium 5.3
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report.CVE-2025-67082 · Other software · Invoiceplane · reported by MITREMedium 6.5
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 thrCVE-2025-58693 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.5
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
- Product
- FortiVoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Jan 8, 2026An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted scriptCVE-2025-56424 · Other software · Insiders-technologies · reported by MITREHigh 7.5
An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause a denial of service via a crafted script
- Product
- E-invoice Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsiders-technologies.commind-bytes.de
Jan 7, 2026A security vulnerability has been detected in invoiceninja up to 5.12.38.CVE-2026-0649 · Other software · reported by VulDBLow 2
A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Jan 7, 2026QR Code for WooCommerce order emails, PDF invoices, packing slips: Stored Cross-Site ScriptingCVE-2025-14626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- QR Code for WooCommerce order emails, PDF invoices, packing slips
- Affected
- up to 1.9.42
- What to do
- Affects up to 1.9.42. Update QR Code for WooCommerce order emails, PDF invoices, packing slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator CVE-2025-59467 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Products: UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier) Mitigation: Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.
- Product
- UCRM Argentina AFIP invoices Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025E-Invoice App Malaysia: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.
- Product
- E-Invoice App Malaysia
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update E-Invoice App Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Print Invoice & Delivery Notes for WooCommerce: Remote Code ExecutionCVE-2025-13773 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Easy Invoice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-6324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affects Easy Invoice: from n/a through <= 2.0.9.
- Product
- Easy Invoice
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
- Product
- PDF Invoice Builder for WooCommerce
- Affected
- up to 6.5.0
- What to do
- Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025InvoicePlane commit debb446c is vulnerable to Incorrect Access Control.CVE-2025-64012 · Other software · Invoiceplane · reported by MITREMedium 4.3
InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 9, 2025An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0CVE-2025-64156 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.2
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests
- Product
- FortiVoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Dec 9, 2025Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 thrCVE-2025-60024 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands
- Product
- FortiVoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Dec 9, 2025WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2025-67589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 8, 2025In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default vaCVE-2025-48629 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after unCVE-2025-48620 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Nov 21, 2025Easy Invoice: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-66115 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.
- Product
- Easy Invoice
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2025An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiVoice 7.2.0 througCVE-2025-58692 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
- Product
- FortiVoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Nov 13, 2025WooCommerce PDF Invoice Builder: Missing AuthorizationCVE-2025-64269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.150
- What to do
- Affects up to 1.2.150. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-64229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Voice Feedback: Incorrect Privilege AssignmentCVE-2025-62007 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through <= 1.0.3.
- Product
- Voice Feedback
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Voice Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.