The Real Post Slider Lite plugin allows administrators to modify settings that are stored in the database without proper sanitization or escaping. Because the plugin fails to filter or escape the data, a malicious administrator can embed JavaScript or other executable code that is rendered when a visitor loads any page that includes those settings. This is a stored cross‑site scripting flaw that can lead to session hijacking, data theft, or redirects to malicious sites for anyone who views the affected page.

The flaw exists in all releases of Real Post Slider Lite prior to and including version 2.4, distributed by the vendor vk011. It only affects WordPress multisite installations where the unfiltered_html capability has been disabled, meaning that administrators are the only users able to perform the injection. Single‑site or non‑multisite setups are not impacted by this issue.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation. However, because the flaw requires administrator access, an insider threat or compromised admin account can still exploit it, warranting timely remediation.