CVE-2026-85293

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2-beta-1

Description InvoicePlane fails to enforce email syntax for client email values and renders them unescaped within double-quoted value attributes in the invoice mailer and quote mailer forms. This allows an administrator to store attribute-breaking input that executes JavaScript when another authenticated administrator opens the associated mailer page. The script operates within the InvoicePlane origin, enabling same-origin actions using the victim's session.

Recommendations Update InvoicePlane to version 1.7.2.