Unauthenticated Cross Site Scripting is revealed in the Master Slider plugin for WordPress in versions 3.11.2 and earlier. The flaw allows malicious input to be rendered as executable script code in a user’s web browser, leading to potential data theft, session hijacking, or defacement. The weakness falls under input validation and output encoding failures, as identified by CWE-79.

The vulnerability affects WordPress installations that have the Master Slider plugin, Averta vendor, version 3.11.2 or earlier. No other products or versions are mentioned as affected.

The CVSS score of 7.1 indicates a high severity. Externally, the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the vulnerability is exploitable without authentication and is inferred to be reachable through publicly accessible pages that render the plugin’s output.