MatrixAddons Easy Invoice versions up to 2.0.9 are affected by a DOM-based Cross-site Scripting vulnerability caused by improper input neutralization during web page generation. This vulnerability can be exploited remotely over the network without privileges but requires user interaction. The issue allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability is tracked as CVE-2025-6324 with a CVSS v3.1 base score of 7.1. No patch or remediation information is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can result in execution of malicious scripts in the context of the user's browser, potentially leading to partial compromise of confidentiality, integrity, and availability of user data or session. The CVSS vector indicates that the attack can be performed remotely with low complexity and no privileges, but requires user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall rules or input validation as temporary mitigations. Monitor vendor communications for updates on patches or official fixes.