The vulnerability is a DOM‑based cross‑site scripting flaw where unsanitized user input is reflected in the page, allowing attackers to inject arbitrary JavaScript into site visitors’ browsers. If exploited, an attacker could run scripts that steal session cookies, perform phishing actions, or otherwise manipulate the user session or data presented on the page. The weakness exists due to improper neutralization of input during web page generation and is classified as CWE‑79.

The affected product is the WEN Themes WEN Logo Slider WordPress plugin. Versions from the earliest available release up through 3.4.0 are impacted. Any site using the plugin version 3.4.0 or older should consider the plugin vulnerable.

The CVSS score of 5.9 indicates a moderate severity; the EPSS metric is not available, so no precise estimate of exploitation frequency can be made. The vulnerability is not listed in the CISA KEV catalog, suggesting no public evidence of exploitation. The likely attack vector is DOM‑based XSS through user‑controlled input that is rendered without proper escaping, meaning an attacker could craft a link containing a malicious payload that, when opened by a target user, will execute the injected script in the victim’s browser.