The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript which is executed within the context of the visitor's browser. This flaw can directly lead to credential theft, redirection, or defacement of the website, compromising confidentiality, integrity, and availability for any user who visits a page that renders the malicious content. The weakness is an input validation failure (CWE‑79) in the Image Slider Widget plugin.

The plugin GhozyLab Image Slider Widget, version 1.1.130 and all earlier releases, is affected. If the plugin is installed on a WordPress site, any content input that is stored by the widget and later displayed can be used to deliver malicious scripts.

The CVSS base score of 6.5 indicates significant risk, and although an EPSS score is unavailable, the absence of exploitation probability data does not mitigate the severity of a stored XSS. The vulnerability is not listed in the CISA KEV catalog, but once a public exploit emerges, it could become a high‑impact threat. The likely attack vector involves submitting malicious code as part of the widget configuration or content, which is stored and later rendered in a user‑visible page.