The HORIZONTAL SLIDER plugin for WordPress is vulnerable to a CSRF-based Stored XSS attack, which could allow an unauthenticated attacker to execute arbitrary scripts in a user's browser.

This vulnerability is a Cross-Site Request Forgery (CWE-352) flaw that permits an unauthenticated attacker to perform unauthorized actions, leading to Stored Cross-Site Scripting. The attack vector relies on a user with administrative privileges interacting with a malicious link or site while logged into the affected WordPress instance.

The exploitation of this vulnerability can lead to the theft of administrative session cookies, unauthorized modification of website content, or the redirection of site visitors to malicious domains. Given the CVSS score of 7.1, this represents a high risk to the integrity and confidentiality of the affected web application and its users.

Immediate Action: Since a specific patch version is currently unknown, administrators should disable or uninstall the HORIZONTAL SLIDER plugin until the vendor releases a security update.

Proactive Monitoring: Monitor WordPress access logs for suspicious requests directed at the plugin configuration endpoints and review site content for unauthorized script injections.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common CSRF and XSS attack patterns targeting WordPress plugin directories.

Public Exploit Available: Unknown.

Due to the severity of stored XSS, which can result in full compromise of administrative sessions, immediate action is required. We strongly recommend removing the vulnerable plugin from the production environment until the vendor provides a verified fix. Continued use of the plugin in its current state poses an unacceptable risk to your web infrastructure.