The Subitem AL Slider plugin for WordPress contains a flaw in its use of the server variable `$_SERVER['PHP_SELF']` that is not properly escaped. This allows an attacker to craft a URL that injects arbitrary JavaScript code which is then reflected back to the visitor’s browser. The injected script can be used to steal session cookies, deface the site, or redirect users to malicious sites. The vulnerability is easy to trigger and does not require any authentication, meaning any site visitor is potentially exploitable.

WordPress installations using the Subitem AL Slider plugin, vendor alexdtn, in all releases up to and including version 1.0.0. No other vendors or products are currently affected.

The CVSS score of 6.1 indicates a moderate severity, highlighting the potential impact of XSS. The EPSS score of less than 1% reflects a low current exploitation probability, but the awareness of this flaw can still drive future attacks. The vulnerability is not listed in the CISA KEV catalog, so there are no known widespread attacker campaigns exploiting it. The attack vector is likely an unauthenticated user visiting a crafted link or URL containing malicious JavaScript; any user who clicks such a link would be affected.