The vulnerability is an improper neutralization input during page generation, allowing stored cross-site scripting when the Off-Canvas Sidebars & Menus (Slidebars) plugin includes user input in the page without proper escaping. This flaw, categorized as CWE-79, can lead to session hijacking, defacement or the execution of arbitrary malicious scripts in the context of visitors.

The affected product is the Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin in all versions up to and including 0.5.9, which are used on WordPress sites that implement off-canvas sidebars and menus.

The CVSS score of 6.5 indicates a moderate severity, and with no EPSS score reported the exploitation probability is uncertain. The plugin does not list this vulnerability in the CISA KEV catalog. The likely attack path is through a victim’s browser when visiting a page that contains the stored malicious payload, so an attacker can inject scripts that run with the privileges of the site visitor. Because the payload is stored, the effect is persistent until the data is removed or the plugin is updated.