The Simple Logo Carousel WordPress plugin contains a stored cross‑site scripting vulnerability caused by insufficient sanitization of the ‘id’ parameter. Authenticated users with Contributor-level access or higher can place arbitrary JavaScript into carousel entries, which the plugin stores and subsequently outputs without proper escaping. When a visitor loads a page that displays the compromised carousel, the injected script runs in their browser, potentially allowing the attacker to manipulate the page or perform other malicious actions.

WordPress sites that have installed the Simple Logo Carousel plugin, version 1.9.3 or earlier. The flaw resides in the plugin’s shortcode handling code (Base/Shortcode.php) and applies to all releases up to and including 1.9.3.

This issue has a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. It is not listed in the CISA KEV catalog. Exploitation requires that an attacker possess Contributor or higher permissions on the target WordPress site; once satisfied, the attacker can inject payloads that will be executed for any visitor who views the manipulated carousel. The risk is therefore contained to sites with permissive contributor access and the consequent visibility of the carousel.