Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-19 | 1 | General1 |
| 2026-02-24 | 1 | Disclosure1 |
CVE-2026-26281 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex inv… https://www.cve.org/CVERecord?id=CVE-2026-26281
Post summary
The CVE-2026-26281 is a stored XSS vulnerability in InvoicePlane's Sumex module, with no mention of PoC, exploitation, or patch.
CVE-2026-26281 Stored Cross-Site Scripting in InvoicePlane 1.7.1 Invoice View Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26281
Post summary
The text reports a stored XSS vulnerability in InvoicePlane 1.7.1 but offers no PoC, exploit code, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | invoiceplane | invoiceplane | 1.7.0 | - | - |