The Slider by BestWebSoft plugin contains an SQL Injection flaw due to insufficient sanitization of user‑supplied input. An attacker that can interact with vulnerable input can inject arbitrary SQL statements, which may read, modify, or delete database records. Depending on the underlying database and permissions of the WordPress installation, this can compromise website integrity and result in significant data loss or unauthorized data exposure.

The vulnerability affects the Slider by BestWebSoft plugin from earlier minor releases through version 1.1.0 on any WordPress installation that includes the plugin. The affected vendor is bestweblayout. No stricter version granularity is provided beyond the ≤1.1.0 ceiling.

The CVSS score is 7.6, indicating high severity. The EPSS score is under 1 %, implying that exploitation is relatively rare at present. The issue has not been listed in CISA’s KEV catalog. Attackers may exploit by sending crafted requests to the plugin, possibly from any web client, making the attack vector likely remote. Although the low EPSS suggests a low probability of immediate exploitation, the high severity warrants swift remediation.