The Ird Slider plugin for WordPress contains a stored XSS flaw in the ‘irdslider’ shortcode that accepts user‑supplied parameters. Because the plugin does not properly sanitize or escape these attributes, an attacker who is logged in with contributor access or higher can inject JavaScript that will run whenever the affected page is viewed by any user. This vulnerability enables malicious script execution, which could lead to defacement, credential theft, or hijacking of a user’s session, thereby compromising the confidentiality, integrity, or availability of the WordPress site.

WordPress sites that have the Ird Slider plugin installed, specifically all released versions up to and including 1.0.2. The problem exists in every version of the plugin where the shortcode is enabled and any contributor or higher user can add or edit content.

The CVSS score of 6.4 indicates a medium severity flaw, while the EPSS score of less than 1% suggests the overall exploitation probability is currently low. The vulnerability is not listed in CISA’s KEV catalog, and no active exploit code is currently known. However, because the flaw requires authenticated access, the attack surface is limited to registered users with contributor-level or higher privileges. If an attacker can gain such access, the stored XSS can be leveraged to run arbitrary scripts in the context of site visitors, potentially escalating the threat if other vulnerabilities are present.