Vulnerabilities

TI-2026-46686 CVE-2026-65516 · GHSA-4966-5qv6-xgv5

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

LOW 37

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00266 Published 2026-07-23 No fix listed CWE-918

TI-2026-46680 CVE-2026-65510 · GHSA-6525-vvv9-4279

LOW 31

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-23 No fix listed CWE-79

TI-2026-46669 CVE-2026-65499 · GHSA-7q74-2jpq-hj7v

LOW 34

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00266 Published 2026-07-23 No fix listed CWE-862

TI-2026-21788 CVE-2026-27372 · GHSA-q265-wj3h-mqcc

LOW 29

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00374 Published 2026-07-23 No fix listed CWE-201

TI-2025-22736 CVE-2025-31573 · GHSA-j4jm-gfjf-w289

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00299 Published 2025-04-03 No fix listed CWE-79

TI-2025-18291 CVE-2025-24574 · GHSA-rmx2-4jx5-xv9c

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00282 Published 2025-02-03 No fix listed CWE-79

TI-2024-32891 CVE-2024-49298 · GHSA-v3x3-3wff-fxjj

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00275 Published 2024-10-17 No fix listed CWE-79

TI-2023-22257 CVE-2023-41864 · GHSA-8x5r-q78q-wvjm

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.002 Published 2024-04-18 No fix listed CWE-352

TI-2024-21405 CVE-2024-32518 · GHSA-8r57-h742-hc9g

LOW 30

Missing Authorization vulnerability in Pepro Dev.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00384 Published 2024-04-17 No fix listed CWE-862