The HT Slider For Elementor plugin for WordPress contains a stored cross‑site scripting flaw (CWE‑79). The vulnerability arises from the 'slide_title' field, which is not properly sanitized or escaped when rendered in JavaScript, allowing an attacker to inject arbitrary scripts that execute in the browser of any user who views the affected page. This can be used to deface content, phish credentials, or execute malicious actions within the site context.

WordPress sites that have the HT Slider For Elementor plugin installed on any version up to and including 1.7.4. The attack is limited to users with Contributor level access or higher, as they can create or edit slides containing a malicious 'slide_title' value.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is below 1%, highlighting that the likelihood of public exploitation today is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Contributor level or higher, so an organization’s least privileged users face the greatest risk if they are compromised. Because the impact occurs on page load for any user, the risk to user sessions and site integrity is significant, though the lack of a widespread exploit and low EPSS suggest that the overall threat is moderate until a patch is applied.