Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress Security & Risk Analysis

The Sprout Invoices plugin, version 20.8.11, exhibits a mixed security posture with some strong practices but also notable concerns. On the positive side, the plugin demonstrates robust SQL query handling, with 100% prepared statements, and a high rate of output escaping (98%). It also includes a significant number of nonce and capability checks, indicating an awareness of common WordPress security mechanisms. However, the presence of 6 AJAX handlers without authentication checks presents a significant attack surface that could be exploited to perform unauthorized actions.

The historical vulnerability data is a significant red flag. With 8 known CVEs, including 2 high-severity and 6 medium-severity issues, the plugin has a history of security weaknesses. The common vulnerability types suggest a pattern of issues related to authorization, data handling, and cross-site scripting. While there are no currently unpatched vulnerabilities, the recurring nature of these issues, even with the latest vulnerability dated in the future (2026-02-15), indicates potential for ongoing security flaws.

Overall, while the plugin employs good practices in certain areas like SQL and output sanitization, the unprotected AJAX endpoints and the history of critical and high-severity vulnerabilities significantly detract from its security. Users should be aware of the potential risks associated with the unprotected entry points and the plugin's past security record. The presence of bundled libraries like Select2, while common, could also be a vector for vulnerabilities if not properly managed and updated.