The AD Sliding FAQ plugin for WordPress contains a stored XSS flaw that arises when the "sliding_faq" shortcode is used with insufficiently sanitized attributes. Authenticated users who have contributor‑level access or higher can insert code that will be rendered and executed whenever a page containing the injected shortcode is viewed by any user. The injected scripts could be used for defacement, credential theft, or session hijacking; however, such specific outcomes are not explicitly detailed in the CVE description and are inferred from the nature of stored XSS.

WordPress sites that run anybodesign’s AD Sliding FAQ plugin version 2.4 or earlier are affected; all such installations are vulnerable regardless of other configurations. The flaw exists in versions up to and including 2.4 and does not impact newer releases that have patched the issue.

The vulnerability carries a CVSS score of 6.4, indicating a moderate impact, and an EPSS score of less than 1 %, showing a very low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Attack requires authenticated contributor or higher access to inject the malicious attributes, so the threat is limited to trusted users or compromised accounts within the site, but compromises the trust boundary of all site visitors.