An unauthenticated attacker can inject malicious scripts through the Slider by 10Web plugin, allowing the execution of arbitrary code in the victim's browser. This flaw enables classic XSS attacks that may lead to session hijacking, defacement, or the delivery of malware, thereby compromising confidentiality, integrity, and availability of the site’s content. The weakness corresponds to CWE‑79, which focuses on improper input validation or escaping of user-supplied data.

All installations of the WordPress plugin Slider by 10Web with a version equal to or older than 1.2.63 are affected. The vendor identified by the CNA is 10Web; any site running these plugin versions faces the vulnerability,

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score is not available, so the likelihood of active exploitation cannot be quantified from this data set. The vulnerability is not listed in the CISA KEV catalog, which reduces its prominence among known exploited weaknesses. Because the attack does not require authentication and can be carried out by delivering crafted input to an exposed form or URL, the attack vector is likely user‑directed interactions, such as clicking a link or submitting a form on the affected site.