This flaw is a DOM‑based Cross‑Site Scripting vulnerability that allows an attacker to inject arbitrary client‑side script into the web page rendered by the Easy Invoice plugin. Because the plugin does not properly neutralize user‑supplied data, an attacker could execute code in a victim’s browser, gaining the ability to steal session cookies, deface the site, or perform phishing attacks within the context of the affected WordPress installation. The impact is a direct compromise of confidentiality and integrity for users interacting with the plugin, but it does not affect availability at the server level.

MatrixAddons Easy Invoice plugin versions up to and including 2.0.9 are affected. The vulnerability applies to all installations of this plugin for WordPress where untrusted input is reflected in the generated HTML without proper escaping.

The CVSS score of 7.1 classifies the vulnerability as High severity. The EPSS score of less than 1% indicates a very low exploitation probability at the current time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, it can be triggered by crafted input in a normal web request, so defenders should consider the risk of an attacker injecting malicious JavaScript via the plugin’s input fields.