The Slider Revolution plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) via the ‘htmltag’ parameter due to improper neutralization of input during web page generation. Authenticated users with administrator or author privileges can inject malicious scripts that persist in the plugin's output and execute in the context of users visiting the affected pages. This vulnerability affects all versions up to 6.7.7. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact. No patch or official fix details are currently available.

An attacker with administrator or author privileges can exploit this vulnerability to inject persistent malicious scripts into pages generated by Slider Revolution. These scripts execute in the context of users viewing the affected pages, potentially leading to theft of user credentials, session tokens, or other sensitive information. The impact is limited to confidentiality and integrity, with no direct availability impact reported. Since exploitation requires authenticated access, the risk is mitigated somewhat by privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Slider Revolution plugin to trusted administrators only and review user roles to limit author privileges. Monitor for plugin updates from the vendor and apply them promptly once available. Avoid using the vulnerable ‘htmltag’ parameter or disable features that allow its manipulation if possible.