The vulnerability allows a user with Contributor privileges or higher to embed unescaped JavaScript into a shortcode attribute. On a post containing the malicious payload, the script is rendered in the browser’s HTML attribute and executes when a visitor views the post, enabling arbitrary client‑side code execution. This could lead to credential theft, session hijacking, or defacement of the site. The flaw stems from a failure to sanitize and escape user input before output, classifying it as a classic stored XSS vulnerability.

WordPress sites that have the Slick Slider plugin installed in a version older than 0.5.3 are affected. All users who can edit content (Contributors or higher) can inject the malicious attribute, and any visitor who opens the afflicted post will execute the payload.

Because the exploit requires only a user with Contributor privileges to edit a post, the attack surface is already within the authenticated user base. Once the payload is stored, it triggers for any page viewer, making the risk high for compromised accounts. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the typical severity for stored XSS is considered high given the broad impact on end‑users. The attack vector is internal via content editing, and no external trigger is required beyond edit access.