Improper neutralization of input during web page generation allows stored XSS in the Vincent Mimoun‑Prat bxSlider integration for WordPress. An attacker able to inject content into any field that the plugin renders—such as a slider caption or description—can cause browsers of other users to execute arbitrary JavaScript when the page is viewed. This leads to theft of credentials, session hijacking, or defacement of the site.

The vulnerability affects WordPress installations that have the bxSlider integration plugin version 1.7.2 or earlier. No other vendors or products are listed as impacted by this CVE.

The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1% signals a low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is via a form or content field exposed by the plugin that accepts user input and renders it without proper escaping; an attacker must have the ability to create or modify such content on the site.