Vulnerabilities and security researches formoloni moloni

Jul 15, 2024

CVE, Research URL: CVE-2024-38694
Home page URL: Security reports for Moloni
Application: Moloni
Date: Jul 20, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Moloni allows Reflected XSS.This issue affects Moloni: from n/a through 4.7.4.
Affected versions: max 4.8.0.
Status: vulnerable

Oct 23, 2026

CVE, Research URL: CVE-2026-106932
Home page URL: Security reports for Moloni
Application: Moloni
Date: Oct 21, 2026
Research Description: The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
Affected versions: max 5.0.14.
Status: vulnerable