XSS in Invoiceplane
CVE-2026-24746
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.003 (19.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Invoiceplane — versions 1.7.0, = 1.7.0
Weakness classification (CWE)
References
- github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-73x8-gr6v-vjvj (Exploit, Mitigation, Vendor Advisory)
- github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942… (Patch)
Frequently asked questions
- What is CVE-2026-24746?
- CVE-2026-24746 is a medium-severity vulnerability in Invoiceplane, classified under Cross-site Scripting. CVSS score: 5.7/10. Published 2026-02-18.
- How severe is CVE-2026-24746?
- Medium severity. CVSS v3 base score is 5.7 out of 10.