This vulnerability is an improper neutralization of input during web page generation, commonly referred to as Cross‑Site Scripting. The flaw allows user‑supplied data to be stored in the SliceWP plugin and later rendered without sanitization, giving an attacker the ability to inject malicious scripts that execute in the browsers of visitors who view the content. The weakness corresponds to CWE‑79 and can lead to theft of session data, defacement of the site, and execution of arbitrary code within the user context.

The affected product is the WordPress SliceWP plugin from vendor iova.mihai. All releases from the first statement of support through version 1.2.6 are vulnerable; upgrading to 1.2.7 or later removes the flaw.

The CVSS score of 7.1 indicates a high severity level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is a stored XSS, which is likely exploitable through any interface that accepts input via the SliceWP plugin such as content entry forms or custom fields. An attacker with write access to that interface can inject malicious payloads that will then execute in the browsers of all visitors rendering the stored content.