The Advanced Reorder Image Text Slider plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an unauthenticated attacker to modify the plugin’s settings. Because the plugin fails to validate a nonce when loading the configuration page, a forged request can inject arbitrary JavaScript into the stored settings. Once stored, the malicious script runs under the context of the site whenever the plugin displays its content, giving attackers the ability to deface pages, steal user data, or install malware on visitors. This vulnerability is classified as CWE‑352 and results in a moderate severity score of 6.1 on the CVSS scale.

WordPress sites that use the Advanced Reorder Image Text Slider plugin version 1.0 or earlier are affected. The plugin is maintained by balasahebbhise and is commonly installed through the WordPress plugin repository.

The CVSS score of 6.1 indicates a moderate threat, and the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure an administrator who is logged in to the site into clicking a malicious link or visiting a compromised page that submits a forged request. If successful, the attacker gains persistent cross‑site scripting capabilities that affect all site users. Because the flaw is unauthenticated but requires administrative interaction, the risk is constrained, but the impact on confidentiality, integrity, and availability of site content can be significant.