The vulnerability arises from the Wonder Slider plugin’s lack of proper input sanitization and output escaping for image titles and descriptions. An authenticated user with Contributor or higher privileges can embed arbitrary JavaScript that will be stored and rendered on any page containing the injected content. This stored XSS can lead to session hijacking, defacement, or theft of sensitive data viewed by other users when they navigate to the affected pages.

The affected products are Wonder Slider and Wonder Slider Lite, as provided by the vendor wonderplugin. All released versions up to and including 14.4 are vulnerable. The flaw exists in the image handling code of the plugin and affects any WordPress site that deploys these plugins in a version ≤ 14.4.

The CVSS score of 6.4 marks the flaw as moderate severity. The EPSS score of less than 1% indicates exploitation probability is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires authenticated Contributor-level access, any site that authorizes contributors to edit slider content could be compromised by a malicious insider or over‑privileged user. The exploit path is straightforward: an authenticated attacker creates or edits a slider image title/description with malicious payload, which is then persisted and executed for all users when the page is rendered.