Improper neutralization of input during web page generation allows DOM‑based cross‑site scripting in the WPZOOM Addons for Elementor plugin. An attacker could inject malicious JavaScript into a page that users load, leading to data theft, cookie hijacking, defacement or execution of arbitrary code within the context of the site. The flaw is classified as CWE‑79 and provides a moderate severity risk of 6.5 on the CVSS scale.

The vulnerability affects WordPress sites that have the WPZOOM Addons for Elementor plugin installed in any version from its initial release through 1.2.10 inclusive. Any instance of the plugin within that version range is susceptible to exploitation.

The CVSS score of 6.5 indicates a moderate impact, while the EPSS score of less than 1% suggests a currently low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Likely attack vectors involve user‑visible parameters or content entered through the plugin’s UI that is rendered via the browser’s DOM, enabling an unauthenticated attacker to supply crafted input to trigger the XSS.