This vulnerability is an improper neutralization of input during web page generation that allows a reflected cross‑site scripting (XSS) attack. An attacker can inject malicious scripts via crafted input, enabling potential defacement of the site, theft of user credentials or session tokens, and execution of arbitrary actions on behalf of visitors. The weakness is a direct result of failing to properly escape user‑supplied data in the Slider Revolution plugin’s rendering logic and is classified as CWE‑79.

The affected product is the WordPress Slider Revolution plugin released by ThemePunch, covering versions from 7.0.0 through 7.0.16. Any WordPress installation using one of these versions of the plugin may be vulnerable and needs to be assessed.

The CVSS score of 7.1 indicates high severity, and although EPSS data is not available, the absence of a KEV listing suggests that widespread exploitation has not been documented. Based on the description, it is inferred that the reflected XSS can be triggered by an attacker sending a crafted request containing malicious input—typically via a URL parameter or an untrusted form field—without requiring authentication or special privileges. The impact is confined to the browsers of site visitors, but could be amplified if the site handles sensitive data or cross‑site cookies.