The Slim SEO plugin software fails to validate the content of the 'Biographical Info' user meta before passing it to shortcode processing. An authenticated user with Subscriber or higher access can store a malicious shortcode payload in this field. When the front-end resolves an author's description through the ?author query parameter (or similar), the plugin calls do_shortcode on the stored payload, executing any shortcode logic, potentially leading to server‑side code execution, data exfiltration, or other malicious actions. This flaw maps to CWE‑94: Improper Input Validation.

WordPress sites running the Slim SEO – AI SEO Plugin version 4.11.1 or earlier, including all prior releases. The affected vendor is rilwis and the plugin name is Slim SEO. Any WordPress installation with these versions is at risk.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is not available, so the exploitation probability cannot be precisely quantified, but the vulnerability is not listed in CISA's KEV catalog, reducing the likelihood of widespread known attacks. The likely attack vector is an authenticated subscriber‑level user exploiting the REST API or the WordPress admin profile page to inject the payload; the malicious code then executes on public pages that display author data. Because the attacker only requires contributor‑level or subscriber access, the risk to sites with minimal access controls is high, and remediation should be prioritized.