The identified flaw allows attacker supplied content to be reflected back to the browser via the PHP_SELF server variable. Because the value is printed without proper sanitization or escaping, an unauthenticated attacker can inject malicious scripts. The consequences may include session hijacking, credential theft, or the delivery of malware when a victim visits a crafted URL that triggers the attack.

All WordPress installations running the Simple AL Slider plugin up to and including version 1.2.10 are vulnerable.

The vulnerability has a CVSS score of 6.1, indicating moderate severity, and an EPSS score of less than 1 %, meaning the probability of exploitation is currently very low. It is not listed in CISA’s KEV catalog. The attack vector is most likely through a crafted link or a malicious URL that references PHP_SELF; no authentication or privilege escalation is required.