Skip to content
OpenAdvisories

Vendor

pravel

3 known vulnerabilities.

Products

Invoice Generator 2 SignUp & SignIn 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-12416 Public exploit

    Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter

    The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce…

    pravel Invoice Generator Web / CMS