The vulnerability is an improper neutralization of user input that results in reflected cross‑site scripting. When a malicious actor submits a specially crafted request to the SUPER RESPONSIVE SLIDER plugin, the payload is reflected back in the generated web page without proper sanitization. This can enable the attacker to execute arbitrary client‑side scripts, leading to session hijacking, cookie theft, defacement, or phishing attempts against site visitors. The likely attack vector is a crafted URL or form submission that includes malicious payloads targeting the plugin’s exposed endpoints. The description implies that a normal browser request can trigger the flaw, meaning no special setup beyond ordinary web traffic is required.

The affected product is the WordPress SUPER RESPONSIVE SLIDER plugin by extendyourweb. Vulnerable versions include any release up to and including version 1.4. Any WordPress site that has installed the plugin in this range is potentially exposed.

The CVSS score of 7.1 indicates a moderate to high severity impact. The EPSS score of less than 1% implies a low but non‑zero probability of exploitation at the time of assessment. The issue is not currently listed in the CISA KEV catalog. Based on the description, the flaw can be triggered by sending a crafted URL or form to the plugin’s endpoints, which are typically accessible to all visitors. No additional privileges or credentials are required to exploit this reflected XSS vector.