Technical impact
The vulnerability allows a user with Contributor privileges or higher to embed unescaped JavaScript into a shortcode attribute. On a post containing the malicious payload, the script is rendered in the browser’s HTML attribute and executes when a visitor views the post, enabling arbitrary client‑side code execution. This could lead to credential theft, session hijacking, or defacement of the site. The flaw stems from a failure to sanitize and escape user input before output, classifying it as a classic stored XSS vulnerability.
Affected Systems
WordPress sites that have the Slick Slider plugin installed in a version older than 0.5.3 are affected. All users who can edit content (Contributors or higher) can inject the malicious attribute, and any visitor who opens the afflicted post will execute the payload.
Risk and Exploitability
Because the exploit requires only a user with Contributor privileges to edit a post, the attack surface is already within the authenticated user base. Once the payload is stored, it triggers for any page viewer, making the risk high for compromised accounts. The EPSS score indicates a very low but non‑zero exploitation probability (<1%). The CVSS score of 5.4 denotes medium severity, and the vulnerability is not listed in CISA’s KEV catalog, but the potential impact on end‑users can be significant. The attack vector is internal via content editing, and no external trigger is required beyond edit access.
