A stored cross-site scripting flaw exists in the Edit Quotes functionality of InvoicePlane version 1.7.0. The quote_number input is not validated, allowing an attacker who can submit data to inject arbitrary scripts that are then rendered when the quote is viewed. Because the vulnerability requires administrator privileges to inject the payload, the potential impact is limited to users who can access the admin interface, but once exploited the attacker can alter stored data, inject persistent backdoors, and fully compromise the integrity of the application.

The specific affected product is InvoicePlane, a self-hosted invoicing application. Only installations running version 1.7.0 are vulnerable; the issue is fixed in version 1.7.1 and later.

The advisory rates the flaw with a CVSS base score of 5.7, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a web application interface that accepts user input; an attacker must first gain administrator access to reach the Edit Quotes functionality. If successful, the stored script can run in the browser of any user who views the edited quote, enabling data tampering and backdoor persistence. Overall, the risk is moderate, but the potential for significant impact warrants prompt remediation.