CVE-2022-1617

Name of the Vulnerable Software and Affected Versions WP-Invoice WordPress plugin versions 4.3.1 and earlier

Description The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in admin change them and add an XSS payload.

Recommendations For WP-Invoice WordPress plugin versions 4.3.1 and earlier, update to a version that includes the necessary CSRF checks and proper sanitization and escaping of settings to prevent exploitation.