The vulnerability is a CSRF flaw that allows an attacker to submit a forged request which results in stored XSS content being inserted into the Image Slider With Description plugin’s database. This malicious code will run in the browser context of any user who later views the slider, enabling data theft, session hijacking, or defacement of the site.

The affected product is the gopi_plus Image Slider With Description plugin for WordPress, with all releases from the earliest version through version 9.2 susceptible. Administrators or users with editing privileges on the slider pages are at risk of exploitation.

The CVSS score of 7.1 indicates a high impact severity, but the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacking the plugin would rely on the web interface for a user with sufficient permissions, exposing the site to stored XSS payloads.