The Simple Nivo Slider plugin for WordPress is vulnerable to stored Cross‑Site Scripting via the 'id' shortcode attribute. Attackers with Contributor or higher privilege can maliciously embed JavaScript that persists in post content. When a user views the affected page, the injected script runs in that user's browser, enabling session hijacking, credential theft, or defacement. This weakness stems from insufficient input sanitization and output escaping, as reflected by CWE‑79.

All WordPress sites that have installed the Simple Nivo Slider plugin up to and including version 0.5.6 are affected. The vendor is tmus, and the plugin is distributed via the WordPress plugin repository. Sites using any WordPress installation with the vulnerable plugin are thus at risk.

The vulnerability has a CVSS score of 6.4, classifying it as medium‑severity. The EPSS score is less than 1 %, indicating a very low but nonzero chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to be authenticated with Contributor or higher access; therefore the vector is an authenticated attack that persists data in the CMS database and manifests when other users load the stored content. If successfully exploited, users could lose session integrity or be redirected to malicious sites.