Improper neutralization of input during web page generation allows a DOM-based XSS vulnerability. This flaw enables an attacker to inject malicious JavaScript that will run in the context of a victim’s browser, potentially exposing session cookies, defacing the site or phishing for credentials. The weakness is described by CWE‑79 and has a CVSS moderate score, indicating non‑critical but still noteworthy risk.

The defect is found in the WordPress Master Slider plugin by Averta. All releases up to and including version 3.10.8 are affected. Site administrators running these versions of the plugin must upgrade to 3.10.9 or later to eliminate the vulnerability.

The CVSS score of 6.5 reflects moderate severity. EPSS information is not available, which means there is insufficient data on how frequently this exploit is used in the wild. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is client‑side DOM manipulation; an attacker can embed malicious code in a webpage rendered by the plugin, or craft a URL that causes the victim’s browser to execute injected scripts. The exploit is easy to trigger from a remote host and requires only a vulnerable plugin on the target site, suggesting a potentially broad impact if multiple sites remain unpatched.