CVE-2026-33628mediumCWE-116CWE-184CWE-79

CVE-2026-33628: medium-severity vulnerability in invoiceninja

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

Published · Updated

Follow this CVE+ Monitor invoiceninja+ Monitor invoiceninja/invoiceninja

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.2%
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
invoiceninja · invoiceninja
Related CVEs — invoiceninja

In the same product, most dangerous first.

CVE-2026-71233HIGHInvoiceNinja - Stored XSS via Invoice/Quote Terms FieldEPSS 0.4%CVE-2026-58450MEDIUMInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended ParameterEPSS 0.3%CVE-2026-82029HIGHInvoice Ninja < 5.13.28 Broken Access Control via Vendor PortalEPSS 0.2%CVE-2026-33742MEDIUMInvoice Ninja has Stored XSS via Markdown HTML Injection in Product NotesEPSS 0.2%