Image Carousel, a WordPress plugin developed by GhozyLab, contains a Contributor Cross Site Scripting flaw in all releases up to version 1.0.0.41. The vulnerability allows an attacker to inject arbitrary client‑side script into web pages that load the plugin, potentially leading to session hijacking, credential theft, or defacement. The weakness is a classic input validation failure and is classified as CWE‑79.

WordPress sites using the GhozyLab Image Carousel plugin, specifically any installation whose plugin version is 1.0.0.41 or earlier. No other WordPress core components are affected.

The CVSS score of 6.5 places this vulnerability in the medium severity range. Although no EPSS score is published, the lack of a KEV listing suggests that widespread exploitation has not yet been observed. Attackers could exploit the flaw by supplying a malicious payload through the plugin’s input fields and have it rendered by unsuspecting users who view the affected content. The primary limitation is that an attacker must be able to inject into the plugin’s form or data source, so users with only read‑only access might not be able to trigger the issue.