The vulnerability is a stored cross‑site scripting flaw stemming from the Family Name field in the product form. When an administrator creates a family with a maliciously crafted name, the name is rendered without HTML encoding in the family dropdown. The payload then executes in any administrator’s browser that opens the product form, enabling an attacker to run arbitrary client‑side scripts, steal session data or deface the UI. This accomplishes malicious code execution on the user’s browser, impacting authentication and session integrity for privileged users.

The affected product is InvoicePlane, version 1.7.0. The issue is resolved in 1.7.1. The product is a self‑hosted web application for invoice management.

The CVSS score of 4.8 indicates moderate severity; however the EPSS score is below 1%, suggesting a low probability of mass exploitation. The flaw is currently not listed in the CISA KEV catalog. Attack requires an authenticated administrator to create a malicious family name, after which any admin browsing the product form will trigger the script. The vulnerability is limited to the web browser context of privileged users and does not directly expose server‑side data or privilege escalation beyond the affected tenant.