Technical impact
The flaw allows an attacker to store malicious script code in the plugin’s data, which is then executed when a browser displays a slideshow. If exploited, a malicious payload could run in the context of a site visitor’s browser, potentially hijacking sessions, stealing credentials, defacing pages, or enabling further attacks. Based on the description, it is inferred that any user who views a slideshow could be affected, though the exact downstream damage is not detailed in the CVE data.
Affected Systems
Jeannot Muller flickr-slideshow-wrapper plugin is vulnerable in all releases from the earliest available version through version 5.4.6 inclusive.
Risk and Exploitability
The CVSS score of 7.1 signifies a high severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation in the current landscape. It is not listed in the CISA KEV catalog. The likely attack vector is web-based; an attacker would need to inject malicious code through any input that the plugin accepts (e.g., creating or editing a slideshow), after which the code is stored and served to users. Because the vulnerability is stored, any visitor to the affected site could unintentionally execute the injected payload.
EUVD