InvoicePlane contains a stored cross‑site scripting flaw in the Sumex invoice view that permits an authenticated user with client and invoice management rights to inject and execute arbitrary JavaScript in the browsers of other users who view the impacted invoice. This capability can lead to session hijacking, data theft, and other malicious actions on behalf of the victim user, exploiting the web application's trust boundary between authenticated user data and client‑side scripts.

The vulnerable code exists in InvoicePlane version 1.7.0. Users who have been granted client and invoice management privileges on the self‑hosted application are potentially able to create or modify invoices that contain malicious scripts. The issue was addressed and fixed in version 1.7.1 released by the vendor.

The CVSS score for this vulnerability is 4.4, indicating moderate severity, and the EPSS score is less than 1%, reflecting a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be an authenticated user with specific privileges, the victim must load the affected invoice, and the attack vector is browser‑side script execution. While the potential impact on confidentiality, integrity, and availability is significant, the likelihood of an attack remains low based on current metrics, though the modest severity warrants timely patching.