WP-Invoice – Web Invoice and Billing

WP-Invoice – Web Invoice and Billing has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; 7 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2016 was the busiest year with 6 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (50%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Request Forgery (CSRF).

7 of the records (88%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, most of them (6) reported by James Golovich.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage88%

Open

Fixed

Get automatic notifications for all WP-Invoice – Web Invoice and Billing vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-97183

WP-Invoice <= 4.3.1 - Authenticated (Subscriber+) Information Exposure

Read the full analysis

Vulnerability Records

8 records


2026-10-09 00:00	WP-Invoice <= 4.3.1 - Authenticated (Subscriber+) Information Exposure WP-Invoice <= 4.3.1	`CVE-2026-97183`	4.3 Medium	Usama Arshad	No
2022-04-27 00:00	WP-Invoice – Web Invoice and Billing <= 4.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting WP-Invoice <= 4.3.1	`CVE-2022-1617`	8.8 High	Mariam Tariq	Yes
2016-02-03 00:00	WP-Invoice – Web Invoice and Billing <= 4.1.0 - Unauthorized Settings Change WP-Invoice <= 4.1.0	`CVE-2016-11006`	6.5 Medium	James Golovich	Yes
2016-02-03 00:00	WP-Invoice – Web Invoice and Billing <= 4.1.0 - Insecure Direct Object Reference WP-Invoice <= 4.1.0	`CVE-2016-11007`	5.3 Medium	James Golovich	Yes
2016-02-03 00:00	WP-Invoice – Web Invoice and Billing <= 4.1.0 - Missing Authorization WP-Invoice <= 4.1.0	`CVE-2016-11010`	5.3 Medium	James Golovich	Yes
2016-02-03 00:00	WP-Invoice – Web Invoice and Billing <= 4.1.0 - Missing Authorization WP-Invoice < 4.1.1	`CVE-2016-11009`	5.3 Medium	James Golovich	Yes
2016-02-03 00:00	WP-Invoice – Web Invoice and Billing <= 4.1.0 - Privilege Escalation WP-Invoice < 4.1.1	`CVE-2016-11011`	8.8 High	James Golovich	Yes
2016-02-03 00:00	WP-Invoice – Web Invoice and Billing <= 4.1.0 - Missing Authorization WP-Invoice < 4.1.1	`CVE-2016-11008`	5.3 Medium	James Golovich	Yes

Showing 1–8 of 8 reports