The vulnerability CVE-2025-67951 affects WPZOOM Addons for Elementor up to version 1.2.10. It is a DOM-based Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can partially compromise confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 6.5, indicating medium severity. No known exploits in the wild or patch information are currently available.

Successful exploitation of this vulnerability can lead to partial disclosure of information, modification of data, and disruption of service due to the DOM-based XSS nature. The attacker needs some level of privileges and user interaction to trigger the vulnerability. The impact is limited but can affect the security posture of websites using the vulnerable plugin version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected WPZOOM Addons for Elementor plugin versions up to 1.2.10. Monitor vendor channels for updates and apply patches promptly once released.