The vulnerability arises from improper neutralization of input during web page generation in ZoomIt WooCommerce Shop Page Builder, allowing malicious JavaScript to be reflected to site visitors. The primary known impact is that the injected script will execute in a user’s browser whenever the crafted page is loaded. Potential client‑side impacts such as cookie theft, session hijacking, defacement, or redirection to malicious sites are typical for reflected XSS flaws and are inferred from the nature of the vulnerability, but are not explicitly stated in the CVE record.

All installations of ZoomIt WooCommerce Shop Page Builder released up to and including version 2.27.7 are affected. Any active site using one of these versions can be compromised through the identified flaw.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be triggered remotely, most likely via a crafted URL or form input that feeds untrusted data into the shop page rendering process. The overall risk is considered moderate due to the severity score, but the small exploitation probability reduces the immediate threat level.