A Cross‑Site Request Forgery flaw in the artanik Slider for Writers WordPress plugin permits an attacker to submit a crafted request that stores malicious JavaScript in content managed by the plugin. Because the plugin does not validate the origin of the request, the attacker can inject scripts that are later executed in the browsers of all users who view the affected content. This Stored XSS can lead to defacement, credential theft, or arbitrary code execution for site visitors.

The vulnerability is present in the artanik Slider for Writers plugin for all releases up to and including version 1.3. The affected component is the core plugin code that handles content submission and rendering.

The CVSS score of 7.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The issue is not listed in the CISA KEV catalog. Attackers would need to convince a user with sufficient privileges to visit a malicious page that performs a CSRF request to the plugin’s endpoint. Once the script is stored, every subsequent visitor to the affected content inherits the attacker’s payload. The lack of a defensive CSRF token is the primary weakness enabling this attack vector.