CVE-2026-97183

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users...

EUVD-2026-96796

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users...

CVE-2026-97183 WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users...

CVE-2026-97183

The WP-Invoice WordPress plugin, in versions through 4.3.1 , contains a vulnerability where several AJAX handlers fail to perform proper capability checks . This security flaw allows any authenticated user, such as a user with Subscriber privileges, to perform unauthorized data retrieval. Specifi...

CVE-2026-97183: Exposure of Sensitive Information to an Unauthorized Actor

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users...

PT-2026-110070

Name of the Vulnerable Software and Affected Versions WP-Invoice versions prior to 4.3.2 Description Several AJAX handlers in the plugin fail to perform capability checks. This allows any authenticated user, including those with Subscriber level permissions, to retrieve personally identifiable...

EUVD-2016-2001

Malware in sbrugna...

EUVD-2016-2000

Malware in sbrugna...

EUVD-2016-1997

Malware in sbrugna...

EUVD-2016-1999

Malware in sbrugna...

EUVD-2022-24906

Malicious code in bioql PyPI...

CVE-2022-1617

The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them...

CVE-2016-11006

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2016-11011

The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...

CVE-2016-11008

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...

CVE-2016-11009

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...

CVE-2016-11010

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...

CVE-2016-11007

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...

CVE-2022-1617

The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them...

CVE-2022-1617 WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF

The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them...