CVE-2023-47786

LayerSlider versions up to and including 7.7.9 carry a cross-site scripting flaw: unsanitized input reaches a page and executes as script in a visitor's browser. Because this is a WordPress plugin, the payload runs in the context of the affected site, and with a scope change it can reach beyond the immediate component. Exploitation needs a low-privileged account and a user to interact, so it's conditional rather than a direct server compromise.

The measured read is that stored or reflected XSS in a plugin is a session-and-content threat, not an unauthenticated takeover. Delivered against an administrator it can hijack privileged actions; against ordinary visitors it enables defacement, redirects, or credential theft in the browser. That's meaningful, but it sits below the plugin file-upload and injection bugs that give attackers code on the server with no interaction at all.

Our angle is inventory tied to proportionate ranking. WordPress plugins are hard to track because they're installed per-site by site owners, so we enumerate where LayerSlider runs and at what version against the 7.7.9 ceiling — then hold it at its medium rating rather than escalating. Detection of anomalous script in plugin-rendered output and prompt updating close it out without displacing the higher-severity items in the queue.