Skip to content
PluginCanary

PeproDev Ultimate Invoice

by Pepro Dev. Group · 5,000+ active installs · Checked 3 Nov 2026
Avoid4 Criticals1 Warning

Avoid: vulnerability published 23 Jul 2026 still has no fix after 14 days.

39/ 100 Canary Score

Based on 3 of 5 areas

Capped at 39: a vulnerability has no patch.

Sub-scores for PeproDev Ultimate Invoice
Ownership100
Maintenance55
Security0
SupportNo data
ReputationNo data

How the score works

Quick answers

Is PeproDev Ultimate Invoice still maintained?
Yes. Last release 8 Mar 2026, 7 releases in the last 24 months. 8 Mar 2026 · wordpress.org
Who owns PeproDev Ultimate Invoice, and has it changed hands?
No change recorded. Main committer blackswanlab since Nov 2022. 3 Nov 2026 · SVN log
Was PeproDev Ultimate Invoice removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is PeproDev Ultimate Invoice safe?
No. 4 known vulnerabilities have no fix in the current version. 23 Jul 2026 · Wordfence Intelligence
Is the latest PeproDev Ultimate Invoice update safe to install?
No ownership change before 2.2.6. No one-star spike after it. 8 Mar 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-2Vulnerability published 23 Jul 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.6 Aug 2026Evidence
  • CriticalSEC-2Vulnerability published 23 Jul 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.6 Aug 2026Evidence
  • CriticalSEC-2Vulnerability published 23 Jul 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.6 Aug 2026Evidence
  • CriticalSEC-2Vulnerability published 23 Jul 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.6 Aug 2026Evidence
  • WarningMNT-2Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
  • InfoSEC-36 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

History: 9 past vulnerabilities, 4 still unpatched in the current version.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master12 Jul 2020 to 12 Jul 2020, 1 commits
peprodev13 Jul 2020 to 15 Oct 2022, 84 commits
blackswanlab7 Nov 2022 to 8 Mar 2026, 33 commits
amirhpcom24 Jul 2024 to 22 Feb 2025, 6 commits

4 committers recorded. No ownership changes recorded since 2020.

Maintenance

Last release
8 months ago
Releases, 24 months
7
Tested up to
6.9 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for PeproDev Ultimate Invoice
Q1 20240
Q2 20240
Q3 20241
Q4 20240
Q1 20251
Q2 20250
Q3 20250
Q4 20255
Q1 20261
Q2 20260
Q3 20260
Q4 20260

Last release 8 Mar 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Last 90 days vs lifetime average rating for PeproDev Ultimate Invoice
Last 90 daysNo reviews
Lifetime4.8
Rating distribution
5 star32
4 star0
3 star0
2 star0
1 star2

Security record

6 vulnerabilities in 24 months (9 on record), 4 with no fix in the current version.

PublishedIssueCVSSAffectedFixed inDays to patch
23 Jul 2026PeproDev Ultimate Invoice <= 2.2.6 - Missing Authorization5.3<= 2.2.6No fixn/a
23 Jul 2026PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure5.3<= 2.2.6No fixn/a
23 Jul 2026PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.2.6No fixn/a
23 Jul 2026PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery7.2<= 2.2.6No fixn/a
Show 5 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
27 Mar 2026PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure7.5< 2.2.62.2.6Before disclosure
18 Feb 2025PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure5.3<= 2.0.92.1.04
15 Oct 2024PeproDev Ultimate Invoice <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.0.62.0.7Before disclosure
15 Apr 2024PeproDev Ultimate Invoice <= 2.0.0 - Missing Authorization5.3<= 2.0.02.0.2n/a
20 Feb 2024PeproDev Ultimate Invoice <= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin7.5<= 1.9.71.9.8n/a

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

5,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for PeproDev Ultimate Invoice
4 May 2026123
11 May 2026279
18 May 2026363
25 May 2026475
1 Jun 2026435
8 Jun 2026418
15 Jun 2026348
22 Jun 2026322
29 Jun 2026301
6 Jul 2026414
13 Jul 2026558
20 Jul 2026522
27 Jul 2026648
3 Aug 2026606
10 Aug 2026610
17 Aug 2026540
24 Aug 2026274
31 Aug 2026262
7 Sep 2026282
14 Sep 2026310
21 Sep 2026258
28 Sep 2026343
5 Oct 2026521
12 Oct 2026370
19 Oct 2026340
26 Oct 2026346
2 Nov 202667

Weekly downloads over the last 4 weeks are 27% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score. Never sponsored.

WebToffee WooCommerce PDF InvoicesScore 90 · 50,000+PDF Invoices & Packing Slips forScore 81 · 300,000+

Facts

Version2.2.6
AuthorPepro Dev. Group
Added13 Jul 2020
Last updated8 Mar 2026
Active installs5,000+
Requires WordPress5.0
Tested up to6.9.11
Requires PHP7.4
CategoryE-commerce & Shopping
Tagspersian, pdf invoice, woocommerce, woocommerce invoice

Other plugins by this author: PeproDev Receipt Uploader for, PeproDev CF7 Database, PeproDev Ultimate Profile Solutions, PeproDev Branches Map (Mapify), PeproDev CF7 SMS Notifier

Questions

Is PeproDev Ultimate Invoice still maintained?

Yes. Last release 8 Mar 2026, 7 releases in the last 24 months.

Who owns PeproDev Ultimate Invoice, and has it changed hands?

No change recorded. Main committer blackswanlab since Nov 2022.

Was PeproDev Ultimate Invoice removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is PeproDev Ultimate Invoice safe?

No. 4 known vulnerabilities have no fix in the current version.

Is the latest PeproDev Ultimate Invoice update safe to install?

No ownership change before 2.2.6. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue