An Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability has been identified in the WP Posts Carousel plugin from teastudio.pl. The flaw allows stored XSS; an attacker can inject arbitrary script code via the plugin's input fields that is then rendered in pages accessed by site visitors, potentially leading to session hijacking, defacement or victim phishing. The weakness is cataloged as CWE‑79 and can compromise confidentiality, integrity, and availability of the affected website.

WP Posts Carousel plugin for WordPress from teastudio.pl, versions up to and including 1.3.8. The vulnerability affects every installation of the plugin that has not been upgraded beyond 1.3.8.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, based on the description, it is inferred that an attacker can submit malicious payloads via the plugin’s input interfaces, which are then displayed to all site users, creating a remote vector for script injection. The risk is therefore significant for sites that rely heavily on WordPress pages rendered by the plugin and maintain user-generated content.