Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in the invoice import feature. An authenticated user with permission to create invoices can import HTML content into an invoice status field. This malicious content is stored and later rendered unsafely in a hidden input field when another authenticated user opens the invoice edit form, allowing execution of attacker-controlled markup within the victim's Akaunting session.