This vulnerability is a DOM-based cross-site scripting flaw present in the Zoho Subscriptions Zoho Billing plugin up to version 4.1. Attackers can inject arbitrary JavaScript into the page that is rendered by the plugin, potentially enabling session hijacking, credential theft, or other client-side attacks. The weakness is classified as CWE‑79, underscoring the failure to neutralize input before it is included in the web page.

WordPress sites that install the Zoho Billing plugin from Zoho Subscriptions and are running any version through 4.1 are affected. No vendor-supplied sub-versions are listed, so the entire range up to the 4.1 release is vulnerable.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation in the current environment. Because the flaw is DOM-based, an attacker must entice a legitimate user to visit a maliciously crafted link or submit a form that contains the vulnerable input; remote code execution is limited to the victim’s browser. The vulnerability is not listed in the CISA KEV catalog, which further reduces the likelihood of mass-scale exploitation.