The WP Posts Carousel plugin is vulnerable to stored Cross‑Site Scripting because the auto_play_timeout parameter is not properly sanitized or escaped. An authenticated user with Contributor-level or higher can submit a malicious payload that is persisted and executed whenever any user accesses a page that processes this parameter. This enables script injection that can steal session data, deface content, or redirect users, compromising confidentiality, integrity, and potentially availability of the affected WordPress site. The vulnerability is limited to pages that use the malicious input, but the impact is significant because the payload runs in the context of any visitor to those pages.

All installations of the WP Posts Carousel plugin for WordPress with version 1.3.7 or earlier, developed by TeastudioPL. The vulnerability applies to any WordPress installation that has the plugin enabled and an authenticated user with Contributor or higher privileges. No specific WordPress core versions are mentioned, so the risk applies broadly to sites running the affected plugin version.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% reflects a very low predicted exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor or higher to create a malicious value for auto_play_timeout, so the primary attack vector is via the plugin’s configuration interface within a controlled WordPress installation. Once injected, the payload survives as stored data and executes for any user browsing the affected page, giving the attacker persistent influence over user experience and potential data theft.