The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are reflected back to the victim’s browser. If executed, this can lead to execution of arbitrary JavaScript in the context of the site, enabling credential theft, session hijacking, or defacement. The weakness is identified as a Cross‑Site Scripting flaw (CWE‑79).

Patel’s Post Carousel & Slider plugin for WordPress is affected in all releases up through version 1.0.4. Any site running one of these versions is vulnerable.

With a CVSS score of 7.1, the flaw presents medium‑to‑high risk, but the EPSS score of less than 1% suggests it is currently exploited infrequently. The attack vector is a reflected XSS scenario, likely triggered by visitors clicking a crafted URL or submitting input that is echoed without proper escaping. No authentication is required; simply being a browser visitor is enough to trigger the exploitation path. Because the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploitation campaign against it at this time.