This vulnerability is an Improper Neutralization of Input During Web Page Generation flaw in the Simbul ZenphotoPress WordPress plugin. Improperly sanitized input is reflected back to the browser, allowing an attacker to inject malicious scripts that execute in the context of any user who views the affected page. The outcome can include theft of session cookies or other sensitive data, defacement, or redirection to phishing sites. The weakness is a classic Cross‑Site Scripting (CWE‑79) issue.

The Sanbul ZenphotoPress plugin is affected in all releases from the earliest available version through version 1.8. Users running any version equal to or older than 1.8 of the ZenphotoPress plugin are vulnerable.

The CVSS score of 7.1 indicates high impact, but the EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, suggesting a low current likelihood of exploitation. The attack vector is remote; an attacker can embed malicious payloads in a crafted URL or form input that, when accessed by an unsuspecting visitor, will execute in the victim’s browser. While exploitation risk is moderate, the ability to hijack sessions or deface a site warrants prompt mitigation.