A cross‑site scripting flaw exists in the data.get function of the Slide Generator component of NextLevelBuilder UI‑UX Pro Max Skill. The flaw allows malicious input to be injected into the generated slide output, causing the browser to execute attacker‑controlled scripts. According to the description, the attack can be performed remotely and has already been disclosed publicly, indicating that attackers could leverage this to compromise user sessions, exfiltrate data, or perform social‑engineering attacks within the application.

NextLevelBuilder UI‑UX Pro Max Skill – the Slide Generator module – is affected for all releases up to and including version 2.5.0. Users running these or older builds should review their deployment to determine whether the component is exposed to untrusted input sources.

The CVSS score of 5.3 classifies the vulnerability as moderate, and the EPSS score is not available, suggesting no known detection of widespread automated exploitation yet. The vulnerability is not listed in the CISA KEV catalog. The attacker requires remote access to supply crafted input to the data.get endpoint; the flaw is exploitable through a standard web interface that ingests slide content. Given the public disclosure and lack of immediate vendor response, the risk to environments that rely on untrusted input remains significant.