The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'aria-label' parameter. Authenticated users with at least Contributor privileges can inject arbitrary web scripts that persist and execute in the context of other users viewing the injected pages. This vulnerability affects all plugin versions up to 3.98.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch information available in the provided data.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of other users who view the compromised pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity impact scope. The vulnerability does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the MetaSlider vendor or WordPress plugin repository for a security update addressing this issue.