The AllInOne – Banner Rotator plugin contains a reflected XSS flaw that fails to sanitize user input before rendering it in the web page. An attacker can supply malicious code via a request parameter, which the plugin echoes back into the page, enabling the execution of arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, defacement, or credential theft.

All releases of the plugin distributed by LambertGroup, named AllInOne – Banner Rotator, up to and including version 3.8 are affected. Any WordPress website that has installed the plugin version 3.8 or earlier is vulnerable.

The flaw is rated as high severity and can be exploited by simply embedding a crafted link that directs a user through the vulnerable plugin. No special privileges are required, making the attack path straightforward for anyone able to influence user traffic. The estimated likelihood of exploitation is low, but the risk remains because of the potential impact on user sessions and the absence of publicly disclosed exploits. This vulnerability is not currently listed in the known exploited vulnerability catalog.