This vulnerability in WPZOOM Shortcodes (<=1.0.5) allows reflected cross-site scripting due to improper input neutralization during web page generation. An attacker can craft a malicious URL or input that, when processed by the plugin, results in script execution in the victim's browser. The CVSS score of 7.1 reflects a high-severity issue with potential impacts on confidentiality, integrity, and availability. No official fix or patch is currently documented, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website's users, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability. Since this is a reflected XSS, exploitation requires user interaction (e.g., clicking a crafted link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WPZOOM Shortcodes plugin or implementing web application firewall (WAF) rules to block malicious input patterns. Avoid clicking on suspicious links that might exploit this vulnerability.