Malicious code in sprout-wcm-service (npm)

The package sprout-wcm-service was found to contain malicious code...

MAL-2025-33809 Malicious code in sprout-wcm-service (npm)

The package sprout-wcm-service was found to contain malicious code...

CVE-2025-24606

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.1...

CVE-2025-22512

Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Help Scout: from n/a through = 6.5.6...

CVE-2024-53819

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.0...

CVE-2021-24787

The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2025-31797

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through = 3.2...

CVE-2025-31797

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through = 3.2...

CVE-2025-31797 WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients allows Stored XSS. This issue affects Sprout Clients: from n/a through 3.2...

CVE-2025-31797 WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through = 3.2...

CVE-2025-31797

CVE-2025-31797 – Stored Cross‑Site Scripting in Sprout Clients (BoldGrid Sprout CRM/Lead Management). Affected: Sprout Clients versions from n/a up to 3.2. Root cause: Improper Neutralization of Input During Web Page Generation. Impact: stored XSS on vulnerable pages. Remediation: fix released in...

PT-2025-14180 · Boldgrid · Boldgrid Sprout Clients

Name of the Vulnerable Software and Affected Versions: BoldGrid Sprout Clients versions 3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

WordPress plugin Sprout Clients 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2020-11056

In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0...

CVE-2025-24606

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.1...

CVE-2025-24606 WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.1...

CVE-2025-24606

CVE-2025-24606: Missing Authorization in WordPress plugin Client Invoicing by Sprout Invoices (Sprout Invoices) — Broken Access Control allowing unauthorized access/privilege escalation in Client Invoicing by Sprout Invoices

CVE-2025-24606 WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through = 20.8.1...

WordPress plugin Client Invoicing by Sprout Invoices 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...

PT-2025-5442 · Sprout Invoices · Client Invoicing

Name of the Vulnerable Software and Affected Versions: Client Invoicing by Sprout Invoices versions prior to 20.8.1 Description: The issue is related to a lack of authorization in Client Invoicing by Sprout Invoices, allowing the exploitation of incorrectly configured access control security...