CVE-2026-85293

The self-hosted open source application InvoicePlane is vulnerable to Stored Cross-Site Scripting (XSS) in version 1.7.2-beta-1 . The root cause is the failure to enforce email syntax on client_email values, which are then rendered unescaped within double-quoted attributes in the invoice mailer a...

CVE-2026-85293 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores clientemail values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote...

PT-2026-98888

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2-beta-1 Description InvoicePlane fails to enforce email syntax for client email values and renders them unescaped within double-quoted value attributes in the invoice mailer and quote mailer forms. This allows an...