The Slideshow Wp plugin allows an authenticated contributor or higher to inject arbitrary JavaScript via the 'sswpid' attribute of the 'sswp-slide' shortcode. Because the attribute value is not properly sanitized or escaped, the injected script is stored in the database and executed whenever any user opens a page containing the shortcode. This is a classic stored XSS flaw (CWE‑79) that enables the execution of malicious scripts in the browsers of visitors to the affected pages.

Every instance of the aumsrini Slideshow Wp WordPress plugin up to and including version 1.1 is vulnerable. The flaw exists regardless of the WordPress version or operating system, as long as the affected plugin is installed and used on a website.

The overall risk is moderate with a CVSS score of 6.4 and an EPSS score of less than 1%, indicating a low current likelihood of exploitation. It is not catalogued by CISA as a known exploited vulnerability. The attack vector is inferred to be authenticated access with contributor privileges; an attacker must have permission to edit or insert the shortcode, which is a prerequisite for the stored XSS payload to be added. Once added, the flaw can be abused by any subsequent visitor to the affected page.