Input validation vulnerability in WP-Invoice – Web Invoice and Billing 4.3.1

The WP-Invoice – Web Invoice and Billing plugin for WordPress has a security vulnerability that affects versions up to and including 4.3.1. This vulnerability allows unauthenticated attackers to make changes to the plugin’s settings and add malicious web scripts to the website without the site administrator’s knowledge. This happens because the save settings function does not contain any nonce validation which means attackers can forge requests and trick administrators into clicking on a link.