This vulnerability is a DOM‑based Cross‑Site Scripting flaw in the Quick Interest Slider plugin for WordPress. An attacker can inject malicious JavaScript that executes in the browser of any visitor who views a page containing the slider, enabling cookie theft, page manipulation, or redirection to malicious sites. The weakness arises from improper neutralization of input during web page generation and is classified under CWE‑79. Based on the description, it is inferred that the attack vector involves inserting the malicious payload through the slider’s configuration or content fields, which is then rendered directly to the browser.

All installations of Quick Interest Slider by Graham version 3.1.5 or earlier are vulnerable. WordPress sites that include this plugin in any form are at risk.

The CVSS score of 6.5 indicates medium severity, while an EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. Exploitation depends on delivery of crafted input—often via administrative or user‑generated fields—so the effect is client‑side and requires the victim to load the affected page.