WordPress security by component
Client Invoicing by Sprout Invoices
Plugin description
Client Invoicing by Sprout Invoices is a WordPress component with 8 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
sprout-invoicesLatest vulnerability
CVE-2026-57418: Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 20.8.13.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-57418
Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 20.8.13.
|
20.8.14 |
CVE6.5
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39562
Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 20.8.10.
|
20.8.11 |
CVE5.3
NVDPending
|
| Mar 13, 2026 |
CVE-2026-32401
Client Invoicing by Sprout Invoices: Filesystem traversal
Client Invoicing by Sprout Invoices is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Feb 19, 2026 |
CVE-2026-25364
Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 18, 2025 |
CVE-2025-64227
Client Invoicing by Sprout Invoices: Code execution
Client Invoicing by Sprout Invoices is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Oct 29, 2025 |
CVE-2025-64229
Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jan 27, 2025 |
CVE-2025-24606
Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Dec 09, 2024 |
CVE-2024-53819
Client Invoicing by Sprout Invoices: A security weakness
Client Invoicing by Sprout Invoices is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|