The vulnerability is a reflected XSS flaw in the WP Simple Slideshow plugin for WordPress. Improper neutralization of input during web page generation allows an attacker to inject arbitrary script that executes in the browser of visitors who view a crafted page or click a malicious link. This is a CWE‑79 weakness, which can lead to session hijacking, credential theft, defacement, or delivering additional malware. The plugin versions through 1.0 are affected.

The affected product is the WP Simple Slideshow plugin developed by takumin, part of the WordPress ecosystem. Any WordPress installation that has this plugin installed and running a version 1.0 or older is susceptible.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can abuse the flaw through normal web requests, typically by embedding malicious scripts in query parameters that the plugin reflects back in the page. Victims must be tricked into visiting a crafted URL, so the risk is primarily to users who interact with an affected site. No special privileges or network conditions are required beyond the ability to craft a URL.