PeproDev Ultimate Invoice

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   PeproDev Ultimate Invoice

Information

Software Type Plugin
Software Slug pepro-ultimate-invoice (view on wordpress.org)
Software Status Active
Software Author peprodev
Software Website peprodev.com
Software Downloads 136,097
Software Active Installs 5,000
Software Record Last Updated August 14, 2026

9 Vulnerabilities

Submit a Vulnerability
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-65510
Jul 23, 2026
Researcher: hhhai
PeproDev Ultimate Invoice <= 2.2.6 - Missing Authorization
5.3
CVE-2026-65499
Jul 23, 2026
Researcher: babyhack
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2026-65516
Jul 23, 2026
Researcher: longnv719
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure
5.3
CVE-2026-27372
Jul 23, 2026
Researcher: Derrick Gilliland
PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure
7.5
CVE-2026-2343
Mar 27, 2026
Researcher: Ashkan Moghaddas
PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
5.3
CVE-2024-13719
Feb 18, 2025
Researcher: Tim Coen
PeproDev Ultimate Invoice <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-49298
Oct 15, 2024
Researcher: LVT-tholv2k
PeproDev Ultimate Invoice <= 2.0.0 - Missing Authorization
5.3
CVE-2024-32518
Apr 15, 2024
Researcher: Abdi Pranata
PeproDev Ultimate Invoice <= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin
7.5
CVE-2024-25933
Feb 20, 2024
Researcher: Abdi Pranata
Title Status CVE ID CVSS Researchers Date
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting Unpatched CVE-2026-65510 7.2 hhhai July 23, 2026
PeproDev Ultimate Invoice <= 2.2.6 - Missing Authorization Unpatched CVE-2026-65499 5.3 babyhack July 23, 2026
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery Unpatched CVE-2026-65516 7.2 longnv719 July 23, 2026
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure Unpatched CVE-2026-27372 5.3 Derrick Gilliland July 23, 2026
PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure Patched CVE-2026-2343 7.5 Ashkan Moghaddas March 27, 2026
PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure Patched CVE-2024-13719 5.3 Tim Coen February 18, 2025
PeproDev Ultimate Invoice <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-49298 6.4 LVT-tholv2k October 15, 2024
PeproDev Ultimate Invoice <= 2.0.0 - Missing Authorization Patched CVE-2024-32518 5.3 Abdi Pranata April 15, 2024
PeproDev Ultimate Invoice <= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin Patched CVE-2024-25933 7.5 Abdi Pranata February 20, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation