Wp Invoice
Vendor:
First CVE: Sep 20, 2019 · Active for 6 years
7
Total CVEs
More Total CVEs than 83% of tracked products
3.5
Avg CVEs / Year
Higher CVE frequency than 82% of tracked products
5.6
Avg CVSS
Higher Avg CVSS than 16% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Wp Invoice over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 20, 2019
6 years ago
Most Recent CVE
Jan 16, 2024
920 days ago
CVE Severity & Scoring
Wp Invoice7 CVEs
100%
All CVEs352,294 CVEs
45%
40%
11%
Medium
Attack Vector
Local0 (0.0%)
Network7 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (85.7%)
Unknown0 (0.0%)
Required1 (14.3%)
Privileges Required
Low1 (14.3%)
High0 (0.0%)
None6 (85.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-11011MEDIUM The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation. | Sep 20, 2019 | 6.5 | 20 | NO | NO |
CVE-2022-1617MEDIUM The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowin | Jan 16, 2024 | 6.1 | 19 | NO | NO |
CVE-2016-11008MEDIUM The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates. | Sep 20, 2019 | 5.3 | 19 | NO | NO |
CVE-2016-11007MEDIUM The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval. | Sep 20, 2019 | 5.3 | 19 | NO | NO |
CVE-2016-11006MEDIUM The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes. | Sep 20, 2019 | 5.3 | 19 | NO | NO |
CVE-2016-11010MEDIUM The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates. | Sep 20, 2019 | 5.3 | 18 | NO | NO |
CVE-2016-11009MEDIUM The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates. | Sep 20, 2019 | 5.3 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Wp Invoice
Top CWEs
Versions
No cataloged versions.