The extendyourweb HORIZONTAL SLIDER plugin versions up to 2.4 contain a CSRF vulnerability that enables Stored XSS attacks. This means an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed in the context of the affected application. The vulnerability has a CVSS 3.1 score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to Stored XSS, allowing attackers to execute arbitrary scripts in the victim's browser, potentially compromising user data and application integrity. The vulnerability affects confidentiality, integrity, and availability to a limited extent. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin to reduce risk. Monitor vendor channels for updates and apply patches promptly once released.