What is the CVSS score of EUVD-2026-48116?

EUVD-2026-48116 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of PeproDev Ultimate Invoice are affected by EUVD-2026-48116?

PeproDev Ultimate Invoice plugin (versions 2.2.6 and earlier) contains an unauthenticated reflected XSS vulnerability affecting all WordPress installations using this plugin, enabling attackers to…

How to fix or mitigate EUVD-2026-48116?

Within 24 hours, audit all WordPress installations for active use of PeproDev Ultimate Invoice plugin versions 2.2.6 or earlier and disable the plugin immediately if business-critical functions can be transitioned to alternative solutions. Within 7 days, implement Web Application Firewall (WAF) rules to block reflected XSS payloads targeting the plugin, enable detailed WordPress security logging focused on admin activities, and conduct targeted phishing awareness training to employees on this specific attack vector. Within 30 days, complete an evaluation of alternative invoice management plugins with demonstrated active security maintenance, establish a formal plugin governance process with vetting criteria, and confirm patch availability or financial risk acceptance for any retained legacy plugin.

PeproDev Ultimate Invoice EUVD-2026-48116

| CVE-2026-65510 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-6525-vvv9-4279

WordPress XSS Peprodev Ultimate Invoice Wordpress Plugin Pepro Dev Group

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network-reachable reflected XSS requires victim interaction (UI:R) with scope change (S:C) into the site DOM; C/I low, availability not meaningfully affected (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:29 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

AnalysisAI

Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is PeproDev Ultimate Invoice, a WordPress plugin used to generate and manage customer invoices, identified by CPE cpe:2.3:a:pepro_dev._group:peprodev_ultimate_invoice. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) - user-controllable input is reflected back into an HTML response without adequate output encoding or input sanitization, so a browser interprets attacker-supplied markup as executable script. Because the plugin exposes the vulnerable parameter to unauthenticated requests, the malicious payload does not require any WordPress session to be delivered, and the CVSS scope change (S:C) indicates the injected code executes beyond the vulnerable plugin's own boundary, affecting the wider WordPress site DOM and any authenticated session viewing it.

RemediationAI

No vendor-released patch version was identified in the provided data, so confirm and apply the fixed release referenced in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-cross-site-scripting-xss-vulnerability) - upgrade to any version later than 2.2.6 once published. As compensating controls while awaiting a patch, deploy a WordPress-aware WAF or Patchstack virtual patch to filter script/markup in the plugin's reflected parameters, and restrict or disable the plugin's public-facing invoice endpoints if they are not needed by anonymous visitors (trade-off: may break customer-facing invoice links). Adding a strict Content-Security-Policy that disallows inline script execution site-wide will blunt reflected XSS payloads, though it can break themes or plugins that rely on inline JavaScript and requires testing before enforcement.