The Simple Responsive Slider plugin for WordPress is vulnerable to stored Cross‑Site Scripting in all versions up to and including 2.0 due to insufficient input sanitization and output escaping. Authenticated users with Contributor level or higher can inject arbitrary scripts into pages that are then executed whenever any user views an affected page, potentially compromising user credentials or defacing the site.

The affected vendor is addix, product Simple Responsive Slider, all versions up to and including 2.0. No specific patch version is provided in the CNA data.

The vulnerability has a CVSS score of 6.4 and an EPSS score of less than 1%, indicating a relatively low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The expected attack vector is a local authenticated attack where a contributor or higher writes malicious content into the slider. Because the attacker must first gain or use an existing contributor account, the risk is confined to sites with many contributor users, but once injected the script can affect all users who view the compromised page.