The Advanced Reorder Image Text Slider plugin for WordPress suffers from a CSRF vulnerability due to improper or absent nonce validation on a settings page. This allows attackers to craft malicious requests that, if executed by an authenticated administrator, can modify plugin settings or inject malicious web scripts. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to unauthorized modification of plugin settings and injection of malicious scripts, potentially compromising site confidentiality and integrity. However, exploitation requires tricking an authenticated administrator into performing an action, limiting the attack scope. There is no indication of impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the plugin settings page and consider disabling or removing the plugin if possible. Monitoring for updates from the vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.