Executive brief
PeproDev Ultimate Invoice is a WordPress plugin used to manage and generate invoices for customers. A security flaw allows unauthenticated attackers to inject malicious scripts into the website, which could lead to the theft of user session data, unauthorized redirects to malicious sites, or the display of fraudulent content to visitors. This vulnerability is particularly concerning as it requires no login credentials to initiate, though it does require a victim to interact with a malicious link or page.
Technical details
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by sending a specially crafted request to a vulnerable site. If a victim (such as a site administrator) interacts with the malicious link or page, the attacker's script will execute in the context of the victim's browser session. This can result in session hijacking, unauthorized administrative actions, or website defacement. As of the advisory date, no official patch has been released, and users are advised to seek mitigation through security rules or alternative plugins.
Affected products
- Pepro Dev. Group PeproDev Ultimate Invoice <= 2.2.6
Timeline
- 2026-04-23: other: Vulnerability reported by researcher hhhai
- 2026-07-23: disclosed: Vulnerability published by Patchstack and NVD