The CVE describes an improper neutralization of input during web page generation in the SEO Slider plugin, which allows DOM‑based cross‑site scripting. When a maliciously crafted input is rendered on a page, it can cause arbitrary JavaScript to execute in the browser of any user who views the affected content. This flaw can be leveraged to deliver malicious payloads to site visitors.

The vulnerability affects the WordPress SEO Slider plugin from seothemes, with all releases up to and including version 1.1.1. Any WordPress installation that has a vulnerable version of this plugin installed and activated is at risk.

The CVSS score of 6.5 indicates a moderate security impact, while the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The feature is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker submitting a crafted payload through the plugin’s input fields or via a specially constructed URL, which is then reflected into the page and executed in the victim’s browser.