Technical impact
The vulnerability is an improper neutralization of input during web page generation, allowing a reflected XSS condition. An attacker can inject and execute arbitrary JavaScript in the browser context of anyone who views a crafted URL or submits a form. This can lead to phishing, credential theft, or session hijacking, but does not provide direct remote code execution on the server.
Affected Systems
LambertGroup UberSlider PerpetuumMobile WordPress plugin versions 2.3 and earlier are affected. Site administrators using these plugin versions should verify the installed version and plan for an upgrade.
Risk and Exploitability
The flaw was rated with a CVSS score of 7.1, indicating moderate to high severity. The EPSS score is less than 1%, signaling a very low but non‑zero probability of active exploitation at this time. It is not listed in the CISA KEV catalog. The flaw requires a user or attacker to supply a crafted request that the plugin fails to escape, so the attack vector is likely via reflected input in the browser from an external source. Because the vulnerability is a classic reflected XSS, it is relatively easy to exploit with minimal effort once the vulnerability is discovered.
