A reflected cross-site scripting vulnerability in the Matamko En Masse plugin for WordPress poses a risk of unauthorized script execution within a user's browser session.

This vulnerability is a reflected cross-site scripting (XSS) flaw, classified under CWE-79, which allows an unauthenticated attacker to inject malicious scripts into the web application. The input is not properly neutralized, leading to the execution of arbitrary JavaScript in the context of the victim's session.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of a user, or the theft of sensitive information displayed on the affected web page. With a CVSS score of 7.1, the vulnerability is considered High, as it can facilitate significant compromise of user data and account integrity without requiring prior authentication.

Immediate Action: Since a specific patch version is currently unknown, users should deactivate and remove the En Masse plugin until an official security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web application firewall logs for suspicious request patterns, particularly those containing script tags or encoded characters in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious input patterns commonly associated with reflected XSS attacks.

Public Exploit Available: Exploit_available: false.

Given the High severity rating and the potential for unauthorized script execution, users must prioritize the removal of the vulnerable component. Organizations should maintain a strict inventory of plugins and ensure that any software lacking a security fix is disabled to prevent potential exploitation.