This vulnerability in WPZOOM Shortcodes (up to version 1.0.3) involves improper input sanitization leading to reflected cross-site scripting (CWE-79). An attacker can craft a malicious URL or input that, when processed by the plugin, results in script execution in the victim's browser. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or disrupt site availability. The reflected nature means the attack requires user interaction, such as clicking a crafted link. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WPZOOM Shortcodes plugin if feasible, or implement web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Monitor vendor channels for updates and apply patches promptly once available.