An improper neutralization of user input in the UberSlider MouseInteraction plugin allows attackers to inject arbitrary JavaScript into web pages that are generated by the plugin. When a victim follows a crafted link or form submission, the injected script runs in the victim’s browser, enabling session hijacking, cookie theft, or drive‑by downloads. The vulnerability is a classic reflected XSS flaw and is identified as CWE‑79.

WordPress sites that install the UberSlider MouseInteraction plugin from the LambertGroup. All releases from an unspecified earlier version up to and including version 2.3 are affected. No specific lower bound is provided, but any site using any of these versions is vulnerable.

The CVSS score of 7.1 reflects a moderate to high impact severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, although it is not zero. The vulnerability is not listed in CISA’s KEV catalog, so no known active exploits have been reported. The likely attack vector is web‑based: an attacker can construct a malicious request that returns a page containing the injected script, typically without requiring authentication. Successful exploitation would affect the confidentiality, integrity, or availability of the user session and could allow further attacks.