Invoice Generator vulnerabilities

2 known vulnerabilities in Invoice Generator from Pravel. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Invoice Generator: Improper Privilege Management

  CVE-2026-12415Jun 27, 2026Pravel

  The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoic

• 9.8 Critical severity

  Invoice Generator: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2026-12416Jun 24, 2026Pravel

  The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce