The Master Slider – Responsive Touch Slider plugin for WordPress contains a stored XSS vulnerability (CWE-79) in its slides callback feature. Authenticated attackers with editor-level access can inject arbitrary web scripts that persist and execute in the context of users visiting the affected pages. This vulnerability is limited to multi-site WordPress setups or installations with unfiltered_html disabled. The vulnerability affects all versions up to 3.9.9. No official patch or fix information is provided in the available data.

Successful exploitation allows an attacker with editor privileges to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to session hijacking, defacement, or other script-based attacks limited to the scope of the affected WordPress site. The impact is limited by the requirement for authenticated editor-level access and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only, especially on multi-site installations or where unfiltered_html is disabled. Monitor for updates from the plugin vendor or WordPress security advisories for a patch or official mitigation steps.