The wpWax "Product Carousel Slider & Grid Ultimate for WooCommerce" plugin contains a stored XSS flaw caused by improper neutralization of user input during web page generation. The vulnerability is classified as CWE-79 and permits attackers to embed malicious scripts that will be executed in the browsers of visitors who view content rendered by the plugin.

Operators of WordPress installations that have the wpWax plugin Product Carousel Slider & Grid Ultimate for WooCommerce versions from n/a up to and including 1.10.0 are affected. Versions released after 1.10.0 have not been identified as vulnerable in the current advisory.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of < 1% suggests a very low but non‑zero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no widely documented attacks at this time. Based on the description, the likely attack vector is through the plugin’s content input fields, where a trusted or compromised administrator could inject script payloads that become stored and subsequently delivered to all site visitors.