Pepro Dev Group
Monthly
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated broken access control in PeproDev Ultimate Invoice WordPress plugin versions 2.2.6 and below allows remote attackers to bypass authorization checks without any credentials, resulting in limited confidentiality and integrity impact against invoice data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation requiring no authentication or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the barrier for opportunistic exploitation.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated broken access control in PeproDev Ultimate Invoice WordPress plugin versions 2.2.6 and below allows remote attackers to bypass authorization checks without any credentials, resulting in limited confidentiality and integrity impact against invoice data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation requiring no authentication or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the barrier for opportunistic exploitation.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.