The vulnerability is a stored cross‑site scripting flaw caused by improper neutralization of user input in the B Slider plugin. When an attacker injects malicious JavaScript through a field that the plugin stores and later displays, the code will run in the browser context of any visitor to the affected site. The impact is primarily loss of confidentiality and potential credential theft or defacement, but it does not provide direct remote code execution on the server.

WordPress users who have installed bPlugins B Slider versions up to and including 2.2.2 are affected. Versions earlier than the listed starting point (N/A) are also included because the vulnerability is present without a specific lower bound. The plugin is distributed as part of the WordPress plugin ecosystem, and any site using it without patching presents the risk.

The CVSS score of 6.5 categorises the weakness as moderate severity. The EPSS score is unavailable, so the likelihood of exploitation is not quantified here. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at the time of this analysis. The likely attack vector is through the plugin's administrative interface, where an attacker can submit malicious payloads that are then rendered in the public site. Successful exploitation requires access to a user account with permission to create or edit slider content.