---
id: CVE-2025-59467
title: >-
  A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices
  Plugin (v1.2.0 and earlier) could allow privilege escalation if an
  Administrator is tricked into visiting a crafted malicious page
summary: >-
  A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices
  Plugin (v1.2.0 and earlier) could allow privilege escalation if an
  Administrator is tricked into visiting a crafted malicious page. 


  This plugin is disabled …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
vendor: ui
product: argentina_afip_invoices
affected:
  - argentina_afip_invoices < 1.3.0
patched:
  - argentina_afip_invoices 1.3.0
published: '2026-01-05'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59467'
references:
  - url: >-
      https://community.ui.com/releases/Security-Advisory-Bulletin-057/6d3f2a51-22b8-47a1-9296-1e9dcd64e073
    label: support@hackerone.com
tags:
  - nvd
epss: 0.0025
epssPercentile: 0.14782
ingestedAt: '2026-09-30T22:27:27.690Z'
---

## Overview

A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. 

This plugin is disabled by default.


Affected Products:
UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier)

 

Mitigation:
Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.

## Affected

- `argentina_afip_invoices < 1.3.0`

## Remediation

Upgrade past the affected range:

- `argentina_afip_invoices 1.3.0`