The Image Slider by Ays plugin fails to properly escape user input when rendering slider pages, resulting in a cross‑site scripting flaw. An attacker who can inject content into the slider configuration can cause any visitor to execute malicious JavaScript at the point where the slider is displayed.

WordPress sites that include Ays Pro: Image Slider by Ays, version 2.7.1 or earlier, are vulnerable. The issue arises from insufficient access control that permits non‑administrators to modify slider content.

The flaw carries a CVSS score of 7.1, indicating high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to alter slider content, which may be possible if access controls are lax. Successful exploitation would result in client‑side script execution on pages that include the slider, potentially compromising user data and site integrity.