Improper neutralization of input during web page generation allows malicious user data to be reflected unencoded in HTML and executed as JavaScript in the victim's browser. This DOM‑based XSS can be leveraged to hijack sessions, deface the site, or perform phishing attacks and follows the parameters of CWE‑79 with a medium CVSS score of 6.5.

The B Slider WordPress plugin provided by bPlugins is vulnerable in every release up to and including version 2.0.6; sites running these versions are affected.

The CVSS score of 6.5 combined with an EPSS probability of less than 1 percent suggests moderate severity and low exploitation likelihood. The vulnerability does not appear in the CISA KEV catalog, indicating no broad, documented exploitation. Based on the description, the likely attack vector involves supplying malicious input that the plugin incorporates into a page without proper sanitization, allowing an attacker to inject and execute arbitrary JavaScript in the context of a site visitor.