The vulnerability is an instance of improper neutralization of input during page generation, allowing a malicious user to inject and execute script code in the victim's browser. This can lead to session hijacking, credential theft, or defacement. The weakness is catalogued as CWE‑79 and is reflected in the plugin’s front‑end code.

Off‑Canvas Sidebars & Menus (Slidebars) plugin version 0.5.8.2 and all earlier releases by developer Jory Hogeveen are affected.

The CVSS score of 6.5 places this as a moderate‑to‑high severity issue. However, the EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the vulnerability is not tracked in the CISA KEV catalog. Likely attackers would craft a malicious URL or form input that is rendered by the plugin’s JavaScript, exploiting the DOM‑based injection path. No special privileges or network access are required beyond the victim visiting a hosted site.