The flaw is an improper neutralization of user input during web page generation in the FWD Slider plugin for WordPress. When the plugin includes data supplied by a visitor without sanitizing it, the data is reflected back in the HTML response. This can allow an attacker to inject and execute arbitrary JavaScript in the victim’s browser, potentially stealing session cookies, defacing content, or redirecting to malicious sites. The vulnerability is a classic Reflected XSS attack as identified by CWE‑79.

WordPress sites that have the FWD Slider plugin installed in version 1.0 or earlier, released by Anil Jailta. All users who load pages that include the plugin and are exposed to its output are affected.

The CVSS base score of 7.1 indicates a medium‑to‑high severity reflected XSS that requires user interaction. The EPSS score of less than 1% suggests a low probability of exploitation at present and the issue is not listed in CISA KEV. The most likely attack vector is a crafted URL or form input that is echoed by the plugin, allowing an attacker to entice a user to click a malicious link and execute the payload. While the likelihood is low, the potential impact on confidentiality of the user’s session data makes remediation advisable.