WP-Invoice
by WordPress
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-11011 | Med | 0.42 | 6.5 | 0.01 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. | ||
| CVE-2022-1617 | Med | 0.40 | 6.1 | 0.00 | Jan 16, 2024 | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them | ||
| CVE-2016-11010 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates. | ||
| CVE-2016-11009 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates. | ||
| CVE-2016-11008 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates. | ||
| CVE-2016-11007 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval. | ||
| CVE-2016-11006 | Med | 0.35 | 5.3 | 0.02 | Sep 20, 2019 | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes. |
- risk 0.42cvss 6.5epss 0.01
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
- risk 0.40cvss 6.1epss 0.00
The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
- risk 0.35cvss 5.3epss 0.02
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.