Improper neutralization of input during web page generation in the ZoomSounds plugin allows reflected XSS. Input submitted through the plugin is inserted into the page output without sufficient sanitization, enabling an attacker to inject arbitrary JavaScript. Such scripts can be used to steal session cookies, deface content, or redirect users to malicious sites, thus compromising the confidentiality, integrity, and availability of the affected WordPress site for any visitor who views the reflected request.

ZoomSounds, a plugin available for WordPress, is affected for all releases from the earliest version through 6.91. The vulnerability tracks all earlier releases, so any WordPress site running ZoomSounds 6.91 or any earlier version is potentially vulnerable.

The CVSS score of 7.1 indicates a high level of severity, but the EPSS score of less than 1% points to a low probability of being exploited in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve a crafted request—either a URL parameter or form input—that is reflected by the plugin into a page response. The attack can be performed by an unauthenticated user who can submit or view the reflected content.