WPZOOM Portfolio contains an improper neutralization of user‑supplied input during page rendering, classified as CWE‑79. The vulnerability allows an attacker to inject malicious script into a reflected response. When a victim clicks a crafted link, the script runs inside the victim’s browser context, enabling actions such as session hijacking, cookie theft, or the injection of additional malicious content. The impact is limited to the victim who views the compromised URL and does not affect the server itself.

WordPress installations that use the WPZOOM Portfolio plugin version 1.4.21 or earlier are affected. The plugin must be updated to at least 1.4.22 to eliminate the flaw.

The CVSS score of 7.1 indicates a high severity for reflected XSS. No EPSS score is available, so the current exploit probability is unknown, and the issue is not listed in the CISA KEV catalog. The likely attack path involves a reflected request, with no authentication required, making exploitation straightforward for attackers who can embed a malicious URL in a link that reaches an authorised user.