The WordPress Wp Text Slider Widget plugin suffers from an improper neutralization of input that leads to stored script injection. An attacker can embed malicious JavaScript into widget content, which will then execute in the browsers of every visitor who views the affected page. This flaw can enable session hijacking, defacement, or delivery of malware. The weakness is classified as CWE‑79.

Any WordPress installation running the Wp Text Slider Widget plugin version 1.0 or earlier is vulnerable. The issue is present from the earliest release through version 1.0 inclusive.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is below 1%, suggesting a low likelihood of real‑world exploitation at present, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be stored XSS injected through the plugin’s content input, so an attacker would need access to create or modify a widget, typically through an administrator account or any user role that can edit widgets. Once injected, the payload is delivered to all site visitors without additional conditions.