InvoiceNinja v5-stable contains a cross-site scripting (XSS) vulnerability in the client portal where the "terms" field of an invoice or quote is rendered using Laravel Blade's raw output directive without HTML sanitization. An authenticated user with invoice creation permissions can inject malicious HTML or JavaScript via the REST API, which executes in the client's browser when viewing the invoice. This vulnerability enables session cookie theft and potential client account takeover. It is distinct from a previously reported XSS vulnerability in the invoice line-item description field.