A DOM-Based XSS vulnerability in the Shazdeh Header Image Slider plugin allows unauthenticated attackers to perform malicious script injection, posing a risk of session hijacking or data theft.

This vulnerability is a DOM-Based Cross-Site Scripting (CWE-79) flaw caused by improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can trigger this vulnerability by enticing a victim to interact with a crafted URL.

The vulnerability carries a CVSS score of 7.1, indicating a high severity due to its potential for unauthorized script execution within the context of a user session. Successful exploitation could lead to the theft of sensitive session cookies, account takeover, or the redirection of users to malicious websites, resulting in significant reputational and operational impact.

Immediate Action: As no official patch is confirmed, administrators should immediately deactivate and remove the Header Image Slider plugin from all WordPress installations until a secure version is released.

Proactive Monitoring: Review web application logs for suspicious URL parameters or unusual script injection patterns that target the plugin's documented endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS payloads and sanitize suspicious input strings directed at the web server.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of DOM-based XSS, this vulnerability poses a clear risk to user security and data integrity. Because no patch is currently available, the most effective mitigation is the immediate removal of the vulnerable plugin from your production environment to prevent potential exploitation.