The WP Posts Carousel plugin contains an improper neutralization of user input during page generation, enabling stored cross‑site scripting that can execute arbitrary JavaScript in the context of a victim’s browser, potentially hijacking sessions or defacing content.

The vulnerability affects the teastudio.pl WP Posts Carousel plugin version 1.3.7 and earlier.

The CVSS base score of 6.5 indicates a medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Stored XSS typically requires an attacker to inject malicious payloads into the workflow of the plugin’s content markup; the likely attack vector is through the plugin’s input area that stores data for display in the posts carousel.