Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-26281

InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

Medium4.4Public exploitEPSS 0.21%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

  1. ID reserved

    By GitHub_M

  2. · 6 days later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-26281, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Medium4.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
NVDNVD · Analyzed3.1Medium4.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.21% · top 88% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.

Weakness

Affected products

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-26281 badge
[![CVE-2026-26281](https://trackcve.app/badge/CVE-2026-26281.svg)](https://trackcve.app/cve/CVE-2026-26281)

Record last updated .