The WordPress Plugin WPZOOM Portfolio version 1.4.21 and earlier contains a reflected cross-site scripting (XSS) vulnerability. This type of vulnerability occurs when user-supplied input is immediately reflected by the web application without proper sanitization, enabling attackers to execute arbitrary scripts in the context of a victim's browser. The provided data does not include vendor advisories or patch information, and no known exploits in the wild have been reported. The vulnerability affects versions up to and including 1.4.21.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin version and apply web application firewall (WAF) rules to detect and block reflected XSS attempts if possible.