InvoiceNinja v5‑stable stores the invoice or quote "terms" field without sanitization, rendering raw HTML or JavaScript using Blade’s raw output directive. An authenticated user who can create or modify invoices can inject a script through the REST API endpoint /api/v1/invoices/{id}. When a client opens the invoice, the malicious script runs in the client’s browser, enabling theft of session cookies and the possibility of taking over the client account. This stored cross‑site scripting flaw compromises both the confidentiality of client credentials and the integrity of their account permissions, and can be leveraged to execute arbitrary actions within the portal.

The affected product is InvoiceNinja, specifically the v5‑stable release that contains the unfiltered terms rendering logic. Any installation deployed via the standard web interface that allows users to create or modify invoices through the public REST API is susceptible. The flaw is independent of enablement of the previously disclosed invoice line‑item description XSS.

The CVSS score of 8.7 indicates a high‑severity vulnerability with wide impact. The EPSS score is not available, but the lack of a KEV listing means no confirmed exploit has been documented publicly yet. However, the attack path only requires an authenticated user with invoice‑creation permissions, so insider or compromised accounts can trivially exploit it. The script executes in the victim’s browser when the invoice is viewed, making it a straightforward client‑side attack that requires no additional network connectivity once the malicious payload is stored.