The WP Posts Carousel plugin contains a stored cross‑site scripting flaw that occurs when user input is not properly neutralized during web page generation. An attacker can inject an arbitrary script that is saved in the carousel content and executed each time a page that includes the carousel is rendered, enabling client‑side code execution.

All sites that use the teastudio.pl WP Posts Carousel WordPress plugin with versions up to and including 1.3.10 are affected. The vulnerability exists in every build within this range and affects all installations that have the plugin installed.

The CVSS score of 6.5 reflects a moderate severity for this stored XSS flaw. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The plugin is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is the plugin’s input fields, where an attacker can submit malicious content that is stored and later rendered. Exploitation requires the ability to insert content via the plugin interface and a user to view the affected page; no privileged access is necessary.