Len Slider contains a CSRF flaw that enables an attacker to force a logged‑in user to load a crafted URL, causing the plugin to echo unsanitized parameters back into the page. This results in reflected XSS, which an attacker can use to run arbitrary scripts in the victim’s browser. The impact is primarily confidentiality and integrity erosion within the context of the victim site, with potential session hijacking or data exfiltration.

WordPress sites that have the Len Slider plugin authored by Igor Sazonov installed in version 2.0.11 or earlier. No other vendors or products are affected.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a malicious link sent to an authenticated user; the attacker needs the victim to visit that link while logged in, after which the reflected XSS payload executes in the victim’s browser.