InvoicePlane 1.7.0 suffers a stored cross‑site scripting flaw in the Edit Invoices feature. The application fails to validate user input supplied to the "invoice_number" field, allowing an attacker with administrator privileges to inject malicious scripts that persist in the database. The injected code can modify application data, create persistent back‑doors, and otherwise compromise the integrity of the system.

The affected product is InvoicePlane, specifically version 1.7.0. Version 1.7.1 contains a patch that corrects the validation failure. No other versions are listed as affected. The vendor is InvoicePlane.

The vulnerability has a CVSS score of 5.7, indicating average severity. EPSS is less than 1%, suggesting a low chance of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires administrator credentials, so the attack vector is confined to users who already have elevated privileges. The overall risk is moderate because active administrators might deploy the stored script to hijack sessions or sabotage data, but widespread attack potential is limited by the privilege requirement.