The wpWax Logo Carousel Slider plugin contains a stored cross‑site scripting flaw. Unsanitized input is saved and subsequently rendered as part of the slider’s output, permitting an attacker to inject malicious scripts that execute within the browsers of users who view the affected content. This improper neutralization of input can lead to client‑side code execution for any visitor.

WordPress sites running the wpWax Logo Carousel Slider plugin through version 2.1.3 are affected. The vendor is wpWax and the product is Logo Carousel Slider. The affected build range is n/a through <= 2.1.3 as indicated by the CNA.

CVSS score 6.5 indicates moderate severity. EPSS < 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker with administrative access to the plugin’s interface or the ability to submit content that is stored and later displayed, enabling the stored XSS payload to be delivered to site visitors.