An improper neutralization of input during web page generation allows reflected XSS in the Logo Slider plugin. This flaw can be exploited by an attacker to inject malicious scripts into pages served by a WordPress site, potentially enabling credential theft, session hijacking, defacement, or redirecting users to phishing sites. The weakness corresponds to CWE-79, where unsanitized request data is echoed back to the browser.

The vulnerability affects The Logo Slider plugin for WordPress, sold by Cynob IT Consultancy. All installed instances from the initial release through version 1.0.0 are susceptible; no later versions are specifically listed as affected.

The CVSS score of 7.1 indicates a moderate severity with a potential for significant impact on confidentiality, integrity, and availability of the web application. However, the EPSS score of less than 1% suggests a very low probability of exploitation in current threat environments, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is likely to involve crafting a malicious URL or input that is reflected in the site's output; based on the description it is inferred that an attacker can trigger the flaw by sending arbitrary data that the plugin does not sanitize before rendering.