The LBG Zoominoutslider plug‑in for WordPress contains an improper neutralization of input during web page generation that results in reflected cross‑site scripting (CWE‑79). When an attacker supplies specially crafted data in an HTTP request, the plug‑in echoes that data back into the generated page without proper sanitization. This flaw allows the injection of arbitrary JavaScript that can then execute in the browser of anyone who views the affected page, potentially enabling session hijacking, defacement, or credential theft.

WordPress sites that use the LambertGroup LBG Zoominoutslider plug‑in with any version through and including 5.4.5 are affected. No other versions are impacted according to the available data.

The vulnerability has a CVSS score of 7.1, indicating moderate‑to‑high severity, but its EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog, and no active exploits have been reported. The attack vector is inferred to be remote via a crafted HTTP request that contains malicious parameters, providing a reflected XSS payload to the victim’s browser. The flaw requires the victim to visit the compromised page; it does not persist across subsequent visits or affect the site’s overall integrity beyond the compromised session.