Improper neutralization of input during web page generation in ZoomIt FoodMenu allows reflected XSS. Based on the description, it is inferred that an attacker can inject malicious JavaScript that executes in a victim’s browser when the page is rendered. This leads to potential session hijacking, credential theft, or defacement of the site, depending on the attacker’s goals. The weakness is a classic Input Validation error (CWE‑79).

ZoomIt FoodMenu for WordPress, versions up to and including 1.20. Any WordPress installation deploying this plugin with a version ≤ 1.20 is vulnerable; no further version granular details are supplied.

The CVSS score of 7.1 marks this as a high‑severity vulnerability, and the EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires that a victim visits a crafted URL or otherwise submits malicious input that is reflected in the HTML output. Based on the description, it is inferred that user authentication is not required for exploitation, as the payload is delivered through the page rendering process.