The Multi Post Carousel by Category plugin for WordPress contains a stored cross‑site scripting flaw tied to the "slides" shortcode attribute. Unsanitized input from that attribute is stored and later output without proper escaping, allowing an attacker who can edit content to inject arbitrary JavaScript that runs whenever a page using the shortcode is viewed by visitors. This can lead to session hijacking, defacement, or phishing attacks against any user who views the affected content.

WordPress sites running the gbsdeveloper Multi Post Carousel by Category plugin, specifically all versions up to and including 1.4. Sites that have enabled the "slides" shortcode in posts or pages are vulnerable. An attacker does not need to compromise the site itself but only needs Contributor‑level or higher access to insert the malicious code.

The vulnerability scores a CVSS of 6.4, indicating medium‑to‑high severity. EPSS data is not available and it is not listed in CISA's KEV catalog, suggesting it is not a widely exploited vulnerability yet. Exploitation requires an authenticated user with permission to edit content using the shortcode. Once a malicious script is stored, it executes in the browser of any user who opens the affected page, without the need for additional attack steps.