Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: pravel Clear all filters
TI-2026-10658 CVE-2026-12415 · GHSA-f3q2-677p-c93v

Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

Priority MEDIUM 50

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00804 Published 2026-06-27 No fix listed CWE-269
TI-2026-10659 CVE-2026-12416 · GHSA-5656-6hgp-4v5v

Weak password recovery in pravel Invoice Generator

Priority MEDIUM 50

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00673 Published 2026-06-24 No fix listed CWE-640
TI-2026-10660 CVE-2026-12417 · GHSA-w6gx-c4x9-qjp2

Weak password recovery in pravel SignUp & SignIn

Priority MEDIUM 50

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0082 Published 2026-06-24 No fix listed CWE-640