CVE-2026-27372 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372

The CVE concerns WordPress plugin PeproDev Ultimate Invoice (admin URL not needed) for affected versions

EUVD-2026-48153

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by longnv719 in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Derrick Gilliland in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

PT-2026-63920

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63926

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65510: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63811

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-27372: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65516: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65499: Missing Authorization

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63930

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-63047

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

CVE-2026-63047

The Events Booking Joomla extension by joomdonation.com versions 5.0.0 through 5.8.1 is vulnerable to invoice data exfiltration . The root cause is an incorrect Access Control List (ACL) check , which fails to properly verify if an actor is authorized to download invoice information. This vulnera...

CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

CVE-2026-63047

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...