Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in one of the vulnerable fields in the General Settings of the plugin...

WordPress Client Invoicing by Sprout Invoices plugin <= 19.9.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Dipak Panchal in WordPress Client Invoicing by Sprout Invoices plugin versions = 19.9.6. Solution Update the WordPress Client Invoicing by Sprout Invoices plugin to the latest available version at least 19.9.7...