Invoice Ninja’s product notes field accepts raw HTML through Markdown rendering. The output is embedded into invoice templates without sanitization via purify::clean(), enabling attackers to store malicious scripts that run in any browser that renders the invoice. This stored Cross‑Site Scripting can lead to session hijacking, defacement, or malicious data exfiltration relative to any user who views the affected invoice.

The issue exists in Invoice Ninja v5.13.0 through v5.13.3 for the invoiceninja:invoiceninja product. The vendor explicitly states that the bug is fixed in v5.13.4, so deployments running earlier versions are vulnerable. The affected products are the source‑available invoice, quote, project and time‑tracking application built on Laravel.

The CVSS base score of 5.4 indicates moderate impact; the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV, implying no known active exploitation. Likely attack vectors involve users with write access to product notes who can introduce malicious HTML, or attackers who can access the database to inject the payload. Because the scripts execute in the context of the viewer, the threat is confined to users who open the compromised invoice or template.