The Carousel‑of‑post‑images plugin for WordPress contains a DOM‑based XSS flaw that originates from improper input neutralization during page rendering. An attacker can inject malicious JavaScript that runs in the context of a site visitor, allowing cookie theft, session hijacking, or deceptive content injection. This weakness is identified as CWE‑79 and is present in all releases up to and including version 1.07.

The flaw affects WordPress installations that use the Carousel‑of‑post‑images plugin from the initial release through version 1.07. The vendor listed for this CVE is RichardHarrison, and no patch version is specifically identified in the CNA data beyond that all earlier releases are vulnerable. Sites running affected versions are at risk until the plugin is updated.

The CVSS score of 6.5 places the issue in the medium severity range. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Despite the low exploitation likelihood, an attacker could still target high‑traffic sites by embedding the XSS payload in a harmless‑looking link or form field. The most likely vector is a DOM‑based approach that requires a user to load a page that contains manipulated plugin output, making the attack easier from a client‑side perspective.