The Post Grid, Slider & Carousel Ultimate WordPress plugin fails to sanitize one of its custom post type settings before outputting it as part of an HTML attribute on the admin edit screen. This omission allows any user with a Contributor role or higher to inject arbitrary JavaScript that is stored with the post. When an administrator later opens the affected item, the code is executed in the administrator’s browser, giving the attacker the potential to hijack sessions or exfiltrate data.

All WordPress installations running the Post Grid, Slider & Carousel Ultimate plugin with a version earlier than 1.8.1 are affected. The flaw applies to any site that has users with Contributor or greater permissions, regardless of the WordPress theme or other plugins.

The vulnerability is a stored XSS that requires a Contributor or higher account to inject the payload, followed by an administrator viewing the content. Although no CVSS or EPSS score is available and the flaw is not listed in CISA’s KEV catalog, the impact is significant because every administrator who visits the edited post will execute attacker‑supplied code. The attack vector is not purely remote; it relies on privileged user input but can be leveraged by attackers who have compromised a Contributor account or recruited a malicious user with that role.