The WPZOOM Portfolio plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute in the context of the victim's browser. The affected versions include all versions up to and including 1.4.29. The vulnerability has a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it can be exploited remotely without privileges but requires user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected site users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The reflected nature means the attack requires user interaction (e.g., clicking a crafted link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as input validation or output encoding if feasible. Monitor WPZOOM's official channels for updates.