The CSSIgniter Team MaxSlider plugin versions up to 1.2.3 suffer from an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This flaw enables an attacker with low privileges to traverse directories and access files outside the intended directory scope, potentially leading to unauthorized disclosure, modification, or deletion of files. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to read, modify, or delete files outside the designated directory, impacting the confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the vulnerability poses a significant risk if leveraged by an attacker, although no active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying strict access controls and limiting plugin usage to trusted environments may reduce risk but do not fully mitigate the vulnerability.