The Master Slider – Responsive Touch Slider plugin contains a stored cross‑site scripting flaw (CWE‑79) that allows authenticated users with contributor or higher role to inject arbitrary JavaScript into the masterslider_pb and ms_slide shortcodes. The plugin fails to properly sanitize and escape user‑supplied attributes, so malicious code is persisted in the database and executed whenever a page containing the injected shortcode is rendered. The primary consequence is a compromise of confidentiality, integrity, and availability for any visitor to the affected pages, as injected scripts run with the site’s privileges.

WordPress sites that use the Master Slider plugin by averta. The vulnerability exists in all releases up to and including version 3.10.8. Sites running any later version are unaffected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% implies a low likelihood of widespread exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires authenticated contributor‑level or higher access; based on the description, it is inferred that the attacker must either possess or acquire such permissions. Once authenticated, the attacker can embed persistent JavaScript that executes in the browsers of all users who view pages containing the compromised shortcodes.