plugin
19 known security issues reported for the Wp Invoice WordPress plugin. Most recent disclosed Jan 16, 2024.
Running Wp Invoice on your site? Check whether your installed version is affected.
Scan your site free[en] The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them
The WP-Invoice – Web Invoice and Billing plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing nonce validation on the save settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malic...
The WP-Invoice – Web Invoice and Billing plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing nonce validation on the save settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malic...
Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability discovered by WPScanTeam in WordPress WP-Invoice plugin (versions <= 4.3.1).
Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability discovered by Mariam Tariq in WordPress WP-Invoice plugin (versions <= 4.3.1).
[en] The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
[en] The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
[en] The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
[en] The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
[en] The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
[en] The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
The WP-Invoice – Web Invoice and Billing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpi_gateway_base::process_payment() function when using the wpi_paypal payment gateway handler in versions up to, and including, 4.1.0. This makes it possible for unauthenticated...
The WP-Invoice – Web Invoice and Billing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpi_gateway_base::process_payment() function when using the wpi_interkassa payment gateway handler in versions up to, and including, 4.1.0. This makes it possible for unauthentica...
The WP-Invoice – Web Invoice and Billing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpi_gateway_base::process_payment() function when using the wpi_twocheckout payment gateway handler in versions up to, and including, 4.1.0. This makes it possible for unauthentic...
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
This plugin is prone to unauthorized setting changes, retrieving invoices of arbitrary users, updating previously invoiced users meta data and privilege escalation of logged in users. Update the plugin.
The plugin does not have CSRF check in place when updating its settings, which could allow attacker to make a logged in admin update them and change the minimum role allowed to access the plugin's features to subscriber for example, which would make invoices available to any authenticated users
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free