Technical impact
The vulnerability exists in the Responsive Thumbnail Slider WordPress plugin, specifically in the responsive_thumbnail_image_management() function. It echoes the user supplied $_GET['id'] value directly into a double‑quoted HTML attribute without proper sanitization or escaping. A loose numeric comparison guard ($_GET['id']>0) is easily bypassed by a string that begins with a numeric prefix, allowing an attacker to inject arbitrary JavaScript. When a victim follows a specially crafted link that includes the malicious id value, the embedded script executes in the victim’s browser, enabling defacement, cookie theft, phishing, or other client‑side attacks.
Affected Systems
All WordPress sites that have the Responsive Thumbnail Slider plugin from nik00726 installed in a pre‑1.1.53 version. The vulnerability affects any site where the plugin’s version is less than 1.1.53, regardless of other WordPress configuration.
Risk and Exploitability
The CVSS score of 6.1 classifies the flaw as a medium‑severe XSS, while the EPSS score of <1% indicates a low current probability of exploitation. The flaw is not yet listed in the CISA KEV catalog. Attackers do not need authentication; they only need to craft a URL containing the malicious id parameter and convince a victim to visit it. Given the ease of creating such links and the high impact of XSS, the risk is moderate but should be addressed promptly.
