The vulnerability allows an authenticated contributor or higher to embed arbitrary scripts into the slider shortcode, resulting in script execution for visitors to the injected page. This can lead to defacement, cookie theft, or other malicious actions that compromise confidentiality and integrity.

Any Post Slider plugin from vendor itpathsolutions, versions up to and including 1.0.4 are affected.

The CVSS score of 6.4 indicates moderate severity while the lack of an EPSS score does not quantify exploit probability; the vulnerability is not listed in the KEV catalog. Attackers need only authenticated access with Contributor level or higher and the ability to add or edit slider shortcodes. Once an affected shortcode is stored, the injected script executes in the browsers of any user who views the page containing that slider.