The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to store and trigger Cross‑Site Scripting (XSS) payloads when rendering the Content Slider Block on a WordPress site. If an attacker can inject arbitrary JavaScript into a slider, they can hijack users’ sessions, deface content, or redirect visitors to malicious sites. The weakness maps to CWE‑79 and is scored as a medium‑severity flaw with a CVSS metric of 6.5.

Product: Content Slider Block by bPlugins, version 3.2.1 or earlier is affected. The issue spans all versions from the initial release up to and including 3.2.1. Users of this plugin on any WordPress installation should treat versions before 3.2.2 as vulnerable.

Given the CVSS score of 6.5, the risk is moderate, but no current evidence of exploitation is shown, as the EPSS score is not available and the vulnerability is missing from the CISA KEV catalog. The attack vector is likely via a site admin or an end‑user who can post content to sliders, so compromised credentials or privileged access to the content editor are prerequisites. An attacker with such access could embed malicious scripts that would execute in the browsers of any visitor who views the affected slider, leading to potential credential theft or defacement.