Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the custom invoice payment terms feature. An authenticated Manager can inject malicious JavaScript by saving a crafted payment-term value. This payload executes when an authorized user opens the Invoice Settings for the same company, leading to script execution in the victim's authenticated session.