Technical impact
The Post Grid, Slider & Carousel Ultimate WordPress plugin fails to sanitize one of its custom post type settings before outputting it as part of an HTML attribute on the admin edit screen. This omission allows any user with a Contributor role or higher to inject arbitrary JavaScript that is stored with the post. When an administrator later opens the affected item, the code is executed in the administrator’s browser, giving the attacker the potential to hijack sessions or exfiltrate data.
Affected Systems
All WordPress installations running the Post Grid, Slider & Carousel Ultimate plugin with a version earlier than 1.8.1 are affected. The flaw applies to any site that has users with Contributor or greater permissions, regardless of the WordPress theme or other plugins.
Risk and Exploitability
The vulnerability is a stored XSS that requires a Contributor or higher account to inject the payload, followed by an administrator viewing the content. The CVSS score is 6.8 and the EPSS score is less than 1%, and the flaw is not listed in CISA’s KEV catalog. The impact is significant because every administrator who visits the edited post will execute attacker‑supplied code. The attack vector is not purely remote; it relies on privileged user input but can be leveraged by attackers who have compromised a Contributor account or recruited a malicious user with that role.
