CVE-2024-49298
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice pepro-ultimate-invoice allows Stored XSS.This issue affects PeproDev Ultimate Invoice: from n/a through <= 2.0.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=2.0.6
- Range: <= 2.0.6
Patches
Vulnerability mechanics
Root cause
"Improper neutralization of user-controllable input before it is placed in web page output allows stored cross-site scripting."
Attack vector
An authenticated attacker with low privileges can inject malicious JavaScript into input fields that are later rendered in invoice pages viewed by other users. The attack is network-based (AV:N) and requires user interaction (UI:R) from the victim, such as viewing a generated invoice. The stored XSS payload executes in the context of the victim's browser session, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface invoice content. [CWE-79]
Affected code
The vulnerability exists in the PeproDev Ultimate Invoice plugin for WordPress (pepro-ultimate-invoice). The advisory does not specify the exact file or function, but the CWE-79 classification indicates that user-controllable input is not properly neutralized before being placed in output served as a web page, leading to stored cross-site scripting.
What the fix does
The patch is not included in the bundle. The advisory references a security fix in version 2.2.6 ("Security Issue Fixed: Randomized invoice archive filenames and removed files after download") but does not describe a specific XSS fix. The changelog for version 2.2.2 mentions "Allowed HTML Tags in Address Display method field" which may be related to the XSS vector. Without a patch diff, the exact remediation cannot be confirmed.
Preconditions
- authAttacker must have a low-privileged account on the WordPress site (e.g., subscriber or customer role)
- inputVictim must view a page that renders the stored XSS payload, such as an invoice or order detail page
- configThe plugin must be installed and active with a version <= 2.0.6
Generated on Jun 18, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.