Stored Cross‑Site Scripting is possible in the iova.mihai SliceWP WordPress plugin due to improper neutralization of input during web page generation. An attacker can inject malicious JavaScript or HTML that is saved in the database and then executed by any user who views the affected content. This can lead to credential theft, session hijacking, defacement, or other client‑side attacks, compromising the confidentiality, integrity, and availability of the site for its visitors.

The SliceWP plugin created by iova.mihai, versions up to and including 1.2.13, is affected. All installations using those versions are vulnerable. Versions starting at 1.2.14 contain the fix and are no longer susceptible to this flaw.

The CVSS score of 7.1 indicates a high potential impact. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, but the flaw remains exploitable on any site running the affected plugin. The likely attack vector is through the plugin’s content submission or configuration interfaces, which are accessible to administrators or authenticated content authors. By embedding malicious payloads into stored content, an attacker can ensure they run in the browsers of other site visitors.