The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient input sanitization and output escaping. An authenticated user with editor‑level permissions can inject arbitrary JavaScript into carousel entries, which will execute whenever any user views a page containing the affected content. This flaw can be exploited to steal session cookies, deface the site, or execute further client‑side attacks.

All versions of the gbsdeveloper Ultimate Multi Design Video Carousel plugin up to and including 1.4 on WordPress multi‑site installations, particularly where the unfiltered_html capability is disabled. The vulnerability applies to any site that hosts carousel entries created by editors.

The flaw carries a CVSS score of 5.5 and an EPSS score of <1%, indicating a moderate severity and a low likelihood of exploitation at the time of analysis. It is not currently listed in CISA’s KEV catalog. Attackers must first authenticate as an editor or higher and have permission to create or edit carousel items. Once a script is injected, it runs in the browsers of all users who view the affected carousel, enabling information theft or defacement. The attack vector is local to the CMS, but the impact is observed by every site visitor.