Matamko En Masse plugin (versions up to 1.0) contains an improper neutralization of input during web page generation. This flaw allows an attacker to embed malicious script into a reflected response, which can be executed in the browser of any user who views the crafted page. The vulnerability is a classic client‑side injection identified as CWE‑79.

The affected product is the WordPress En Masse plugin from the vendor Matamko, specifically versions from n/a through 1.0 inclusive. Any WordPress installation using these versions of the plugin is potentially vulnerable until the issue is resolved.

The CVSS score of 7.1 indicates a high risk for browsers that load the vulnerable pages. The reported EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The exploit is inferred to be conducted via a crafted URL or input field that the plugin re‑displays without proper encoding, so attackers can target any user who follows a malicious link or visits a specifically constructed page.