This vulnerability, identified as CVE-2026-65510, affects PeproDev Ultimate Invoice software versions up to 2.2.6. It is an unauthenticated cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation (CWE-79). The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, requiring user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject malicious scripts into web pages viewed by other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or data. The CVSS vector indicates a high impact on these security properties, but exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewalls or input validation as temporary mitigations.