Read the docs

pravel

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

pravel records in CISA KEV

No pravel vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-10660 CVE-2026-12417 · GHSA-w6gx-c4x9-qjp2

Weak password recovery in pravel SignUp & SignIn

Priority MEDIUM 50

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0082 Published 2026-06-24 No fix listed CWE-640
TI-2026-10659 CVE-2026-12416 · GHSA-5656-6hgp-4v5v

Weak password recovery in pravel Invoice Generator

Priority MEDIUM 50

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00673 Published 2026-06-24 No fix listed CWE-640
TI-2026-10658 CVE-2026-12415 · GHSA-f3q2-677p-c93v

Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

Priority MEDIUM 50

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00804 Published 2026-06-27 No fix listed CWE-269
Open these records in search →