CVE-2026-85293 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

The self-hosted open source application InvoicePlane is vulnerable to Stored Cross-Site Scripting (XSS) in version 1.7.2-beta-1 . The root cause is the failure to enforce email syntax on client_email values, which are then rendered unescaped within double-quoted attributes in the invoice mailer a...