The Slick Slider WordPress plugin versions prior to 0.5.3 contain a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of shortcode attribute values before rendering them in HTML attributes. This vulnerability enables users with at least Contributor privileges to inject persistent malicious scripts that execute in the context of other users viewing the post, potentially leading to session hijacking or other script-based attacks. No CVSS score or vendor remediation information is currently available.

The vulnerability allows stored Cross-Site Scripting attacks by users with Contributor role or higher, which can lead to execution of arbitrary JavaScript in the context of other users viewing the affected post. This can result in session hijacking, defacement, or other malicious actions performed on behalf of the victim user. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role privileges or avoid using the affected plugin versions. Monitor for updates from the plugin vendor regarding a security patch.