Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress, CVE-2021-24787

CVE, Research URL: CVE-2021-24787
Home page URL: Security reports for Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress
Application: Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress
Published on: Nov 17, 2021
Research Description: The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected versions: max 20.5.4.
Status: vulnerable

Client Invoicing by Sprout Invoices &#8211; Easy Estimates and Invoices for WordPress, CVE-2021-24787