CVE-2026-18344 is a reflected cross-site scripting vulnerability in the Wp Responsive Thumbnail Slider WordPress plugin. The flaw arises because the 'id' parameter from the URL query string ($_GET['id']) is echoed directly into a double-quoted HTML attribute without proper escaping (no esc_attr() call). The only check is a loose numeric comparison that can be bypassed by strings starting with numeric characters. Additionally, the wp_magic_quotes() function's addslashes() does not provide effective HTML attribute escaping, allowing injection of arbitrary scripts. This vulnerability enables unauthenticated attackers to inject and execute malicious scripts in the context of users who click on crafted links.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, leading to potential information disclosure or session hijacking for users who interact with maliciously crafted links. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links that include the 'id' parameter targeting this plugin. Monitoring for updates from the plugin vendor nik00726 is recommended to apply any forthcoming official patches or mitigations.