The vulnerability resides in the Logo Carousel Gutenberg Block plugin for WordPress, where the sliderId parameter is accepted without proper sanitization or output escaping. Because of this flaw, an authenticated user possessing Contributor or higher privileges can embed malicious scripts that are stored within the plugin’s content. When a user subsequently visits a page that includes the injected slider, the browser executes the attacker‑supplied JavaScript, potentially allowing cookie theft, session hijacking, defacement or other client‑side attacks. The impact is therefore a compromise of confidentiality, integrity, and potentially availability for users who view the affected pages.

The affected component is the Awesome Logo Carousel Block plugin developed by binsaifullah. Versions 2.1.6 and earlier may contain the flaw. The original description cites 2.1.6 as the last vulnerable release; thus any site running this plugin at or below that version is at risk.

The CVSS score of 6.4 indicates a medium severity, while the EPSS score of less than 1% signals a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires Contributor‑level access and the ability to edit or create the block, the attack vector is likely internal or requires an insider. Though the risk of exploitation is modest, the potential impact of any succeeds is significant.