The vulnerability is an improper neutralization of user input that allows reflected XSS in the visualslider Sldier plugin. When an attacker crafts a URL containing malicious JavaScript, that script is reflected back in the web page and executed in the victim’s browser. This can enable session hijacking, credential theft, or defacement of the site. The flaw is a classic injection weakness identified as CWE‑79.

The flaw affects the WordPress plugin visualslider Sldier by the vendor dastan800. All released versions from the original build through version 1.1.1 are vulnerable; any installation of the plugin with a version identifier of 1.1.1 or earlier is at risk.

The CVSS score of 7.1 indicates a moderate to high severity for exploitation. The EPSS score of less than 1 % suggests that, while the probability of automated exploitation currently is low, the vulnerability remains present and could be leveraged via manual attacks. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request to a public page served by the plugin, where the input is reflected without proper output encoding.