InvoicePlane stores the client_email field without validating its syntax and renders it directly inside double‑quoted value attributes in the invoice and quote mailer forms. An administrator who can edit a client can inject attribute‑breaking characters, causing JavaScript to execute when any authenticated administrator loads the related mailer page. The injected script runs in the InvoicePlane origin and therefore can perform same‑origin actions such as modifying data, creating records, or exfiltrating information using the victim's authenticated session.

Vendors affected are those running the open‑source InvoicePlane application. The vulnerability exists in version 1.7.2‑beta‑1 and is resolved in release 1.7.2. All installations that have not applied this update, including earlier pre‑release or unreleased versions, remain susceptible.

The CVSS score of 4.8 places the weakness in the moderate category. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess administrative privileges to edit a client, and the malicious payload is only triggered when another authenticated administrator opens the mailer page. Consequently, the risk is primarily internal: privileged users can inject arbitrary JavaScript to compromise other admins' sessions within the application.