The vulnerability arises from improper neutralization of user input during web page generation, allowing an attacker to store malicious script code within the Griden:Responsive Slider plugin. When the slider output is rendered, the script executes in the context of site visitors, potentially enabling session hijacking, credential theft, or phishing attacks. This weakness is a classic Stored XSS flaw (CWE‑79) that jeopardizes confidentiality, integrity, and availability of the site’s users.

Any WordPress site running the Griden:Responsive Slider plugin at version 0.1.9 or older is affected. The vulnerability applies to all releases from the initial launch up through and including 0.1.9; later releases have not been identified as vulnerable.

The CVSS score of 6.5 indicates medium severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting limited exploitation to date. The attack vector is inferred to be a write‑up by any user with editing privileges on slider content; an attacker who can inject stored content that is later displayed triggers the XSS. Once injected, the script runs with the visitor’s privileges, posing a significant risk to session data and site integrity.