The Side Slide Responsive Menu plugin is affected by a missing or incorrect nonce check, which allows an unauthenticated attacker to send a forged request that updates the plugin’s settings. By doing so, the attacker can inject arbitrary JavaScript that is stored in the database and executed in the context of the site, resulting in a stored Cross‑Site Scripting (XSS) vulnerability. The weakness is a classic Cross‑Site Request Forgery flaw (CWE‑352).

All WordPress sites that have installed the Side Slide Responsive Menu plugin version 1.0 or earlier, provided by the vendor dejocar. The vulnerability applies to each installation of the plugin in those versions regardless of WordPress core or theme.

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% suggests that the vulnerability is unlikely to be widely exploited at this time. It is not listed in the CISA KEV catalog. Exploitation would require the attacker to lure an administrative user into clicking a crafted link or otherwise submitting a forged request that bypasses nonce validation. If the target site lacks monitoring for unauthorized script changes, an attacker could achieve persistent client‑side code execution with potential for data theft or automated defacement. The risk is moderate but real, particularly for high‑traffic or highly valuable sites.