This vulnerability lies in the Divi Carousel Maker plugin for WordPress and allows an authenticated contributor or higher to inject arbitrary JavaScript into the Image Carousel and Logo Carousel widgets. The input supplied by users is neither sanitized nor properly escaped, so the payload is persisted in the database and executed whenever a visitor loads a page that renders the affected widget. Such injected scripts can be used to hijack user sessions, deface content, or launch phishing attacks. The issue is a classic stored XSS flaw (CWE‑79).

The affected component is the Divi Carousel Free (Divi5 Support) WordPress plugin, version 2.0.4 and all earlier releases. WordPress sites that install this plugin and use any image or logo carousel widget are vulnerable. The CPE entry confirms it is a WordPress plugin from Elegant Themes. Any user with contributor‑level or higher access to the site can exploit this flaw.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1 % suggests it is not currently widely exploited. Because the flaw is stored, an attacker does not need additional user interaction; any viewer of the injected page will run the malicious script. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated contributor access but does not need additional exploits or configuration changes beyond inserting the malicious payload. This combination of a moderate rating and an authenticated attack vector results in a risk that should be mitigated promptly, especially on sites that are publicly reachable.