The MetaSlider "Slider, Gallery, and Carousel" plugin for WordPress is vulnerable because the aria‑label field is stored without proper sanitization or escaping. An authenticated user with Contributor or higher permissions can inject arbitrary JavaScript into the field. The injected script is stored in the database and rendered on every page that displays the affected slide, allowing the attacker to run code in the browsers of all visitors who view the injected page, potentially compromising user accounts and data. This is a classic stored XSS flaw (CWE‑79).

All WordPress sites running MetaSlider versions up to and including 3.98.0 are affected. The vulnerability targets the plugin component "Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider" and its associated WordPress integration. No specific OS or PHP version constraints are listed in the CVE data.

With a CVSS score of 6.4 the flaw is considered moderate in severity. The EPSS score of less than 1% indicates a low exploit probability at the time of analysis. It is not listed in the CISA KEV catalog. The likely exploit path requires an authenticated Contributor or higher to access the slide editing interface, inject a malicious payload into the aria‑label field, and then wait for any site visitor to load the page containing the stored script. Due to the need for authenticated access, the threat is limited to sites where the attacker can gain or already possesses such privileges.