Easy Invoice – Invoice Generator, PDF Quotes & Payments
Easy Invoice – Invoice Generator, PDF Quotes & Payments has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 5 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 3 disclosures.
The most common weakness is Missing Authorization, behind 2 of the records (40%). Other recurring categories include Code Injection, Cross-Site Scripting.
Every one of the 5 issues recorded for Easy Invoice – Invoice Generator, PDF Quotes & Payments has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. Easy Invoice – Invoice Generator, PDF Quotes & Payments is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-48836Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.1.19 - Unauthenticated Remote Code Execution
Read the full analysisVulnerability Records

Easy Invoice – Invoice Generator, PDF Quotes & Payments
Author
MatrixAddons
Easy Invoice turns your WordPress site into your invoicing system. Create invoices and quotes, send them as PDFs, take payment on the invoice page and keep every client’s history in one place — with no per-document limits, no watermarks and no trial period. It is built for freelancers, consultants, agencies and small businesses that would rather not pay a monthly fee for a separate invoicing service, and for developers who want invoicing that follows WordPress conventions: custom post types, capabilities, hooks, a REST API and coding standards. Live demo · Documentation · Product page & Pro pricing · Support forum What the free plugin does Invoices and quotes Unlimited invoices and quotes, with automatic numbering and your own prefix — numbers stay unique even when two people save at the same moment Line items with quantities, per-line or global tax, and discounts calculated before or after tax Convert an accepted quote into an invoice in one click; clone any document Credit notes against issued invoices; client statements with running balances Notes, terms, due dates and payment instructions per document; default terms in Settings PDF and print PDFs are rendered on the server (real, selectable text) with your logo and business details Nine document designs: default, modern, classic, minimal, corporate, professional, elegant, creative and legacy Rename any label (“Grand Total”, “Net”, your language) without touching code Download from the admin, from the public invoice page, or through the REST API Getting paid PayPal checkout with a Pay Now button on every invoice Bank transfer, cheque, cash and any offline method you add (ACH, wire…) — the client sees your instructions, sends a reference and a receipt, and you confirm the payment from the Payments screen Payment history with partial, paid and overdue states A custom Pay Now link for any other provider Clients Unlimited client records with billing details and a complete per-client history Invoice and quote emails with the PDF attached, from templates you edit Every emailed link carries a private access key: a document is shown to you, to the signed-in client it belongs to, or to someone with the emailed link — never to whoever guesses a URL Import from Sliced Invoices or Sprout Invoices in one click, or from CSV files with downloadable templates Localisation 121 currencies, with symbol, position, decimals and separators set per document Dates in the site’s timezone; translation-ready (text domain easy-invoice) Multisite compatible For developers REST API for invoices, quotes, clients and PDFs — API reference Migration from Sliced Invoices and Sprout Invoices built in Actions and filters at every step; documents are custom post types you can query WordPress coding standards, escaped output, prepared SQL, nonce-protected actions Tested with 10,000 invoices and 10,000 quotes on one site: every admin screen stays under a second Easy Invoice Pro: 26 addons, switch on what you need Easy Invoice Pro is a separate plugin that adds addons on top of the free one. Each addon has its own on/off switch under Easy Invoice → Addons; an addon you leave off loads no code and runs no queries. Pro requires Easy Invoice 2.4.0 or newer. Personal — 16 addons, on as soon as Pro is installed (no licence key needed to use them) Recurring Invoices & Subscriptions — generate and email invoices on any schedule; optional auto-charge through Stripe or PayPal Partial Payments & Deposits — require a deposit, let clients pay the balance in instalments Client Portal — clients log in to view invoices, download PDFs, see payments and accept or decline quotes PDF Toolkit — watermarks (PAID, DRAFT, OVERDUE, VOID or your own), custom headers, footers, colours and fonts Custom Invoice & Quote Templates — a visual builder for your own layouts Item Library — saved products and services with price and SKU, inserted in one click Bulk Email & Export — email batches of invoices; export selected rows or everything to CSV, Excel or PDF Additional Tax Lines — unlimited named taxes per invoice (VAT + duty, GST + PST, federal + state) Email Enhancements — your own HTML email layout; replies routed by kind Secure Links — signed, expiring document URLs Payment Links & QR Codes — a link or QR code for a fixed or open amount, usable anywhere Quote E-Signatures — clients sign when they accept a quote; signature, name, time and connection recorded Quote Request Forms — WPForms, Gravity Forms, Contact Form 7 or Fluent Forms submissions become draft quotes WooCommerce Invoicing — an invoice for every paid order; refunds become credit notes Reports & Analytics — revenue, outstanding balances, per-client performance, month-by-month profit and loss Privacy & GDPR — client documents included in WordPress personal-data export and erasure requests Pro payment gateways (alongside the free PayPal, bank transfer, cheque and cash): Stripe (cards, Apple Pay, Google Pay, Link, 3-D Secure), Square, Authorize.Net, Mollie (SEPA, iDEAL, Bancontact, Klarna), Paystack (cards, bank transfer, USSD, mobile money) and Moneris. Professional — 6 more addons, with a Professional licence Time Tracking & Project Billing — start/stop timer, per-project and per-client entries, one click to invoice lines Expense Tracking — billable expenses with receipts and markup, rolled into invoices Smart Reminders & Late Fees — a multi-step reminder cadence, automatic late fees and early-payment discounts E-Invoicing — Factur-X / ZUGFeRD (EN 16931) PDFs and Peppol UBL for public-sector and EU customers Client Language — every document for a client, page, PDF and email, produced in the client’s language Retainers & Prepaid Credit — record a block of hours or a prepayment and draw it down invoice by invoice Agency — 4 more addons, with an Agency licence White-Label & Brand Override — your name, menu, icon, PDF footer and email signature; every upgrade prompt hidden Team Members & Audit Log — Manager, Accountant, Sales and Viewer roles, and a searchable log of every action Accounting Sync — QuickBooks Online, Xero and FreshBooks: invoices push out, payment status comes back Webhooks & Zapier — invoice events to any URL, HMAC-signed with retries; drops into Zapier, Make or n8n See plans and pricing — every Pro plan has a 14-day money-back guarantee. Upgrading keeps every invoice, quote, client and payment the free plugin created. Who uses Easy Invoice Freelancers — quote, invoice and collect payment from one screen Agencies and studios — per-client history, statements, deposits and a client portal Shops and B2B sellers — proper invoices for WooCommerce orders and everything the cart can’t bill Consultants and service firms — billed hours, expenses, retainers and e-invoices for larger customers Privacy Easy Invoice stores everything in your own WordPress database and sends nothing to us. The plugin contacts outside services only when you use them: the payment gateway you configure (PayPal in the free plugin), and the WordPress.org update check that every plugin performs. Card details never touch your site — they are handled by the gateway. With the Pro Privacy & GDPR addon, a client’s invoices, quotes and payments are included in WordPress’s personal-data export and erasure requests. Translations Easy Invoice is translation-ready (text domain easy-invoice, .pot in /languages). Translate it with Loco Translate, Poedit or on translate.wordpress.org.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C