A stored cross‑site scripting flaw exists in the Invoice Number field of InvoicePlane 1.7.0. An authenticated administrator can embed arbitrary JavaScript into an invoice number. When any administrator views the affected invoice or the dashboard, the injected script is executed in their browser, allowing for defacement, cookie theft, or navigation to malicious sites. This is a classic CWE‑79 input‑validation weakness that can compromise confidentiality and integrity for privileged users.

The vulnerability applies to the self‑hosted open‑source InvoicePlane application, specifically version 1.7.0 and earlier. The affected component is the invoice number input in the invoice view and dashboard. The patch is delivered in version 1.7.1. Administrators who run older releases or have not applied the update are at risk.

The CVSS score is 4.8, indicating moderate risk. The EPSS score is below 1 %, suggesting that exploitation is unlikely at the time of this analysis. The flaw is not listed in CISA's KEV catalog. An attacker must first authenticate as an administrator; once they do, the stored payload is executed for any other administrator who opens the invoice or visits the dashboard. Without administrative access the vulnerability is not exploitable, so the threat is confined to privileged users.