The affected WordPress plugin does not neutralize user‑supplied content before inserting it into web pages, creating a DOM‑based cross‑site scripting flaw. An attacker can inject malicious JavaScript that runs when a visitor loads the page.

Any WordPress installation that uses the subhansanjaya "Carousel Horizontal Posts Content Slider" plugin on a version up to and including 3.3.2 is vulnerable. No further version precision is provided by the CNA.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious input added to the plugin’s content area that is then reflected in a browser context; an attacker would need to target a user who views the affected page. Given the nature of DOM‑based XSS, exploitation requires the victim to load the content, making it a low‑to‑moderate likelihood attack under present conditions.