EUVD-2026-48110

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372

The CVE concerns WordPress plugin PeproDev Ultimate Invoice (admin URL not needed) for affected versions

CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

EUVD-2026-48153

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by longnv719 in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Derrick Gilliland in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

CVE-2026-65499: Missing Authorization

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63926

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63920

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65516: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63811

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65510: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63930

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

WordPress PeproDev Ultimate Invoice plugin < 2.2.6 - Unauthenticated Invoice Archive Download vulnerability

Unauthenticated Invoice Archive Download vulnerability discovered by Ashkan Moghaddas in WordPress Plugin PeproDev Ultimate Invoice versions 2.2.6...

CVE-2026-2343

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII...

CVE-2026-2343

The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII...