An improper neutralization of input within the Owl Carousel WP plugin allows a stored cross‑site scripting attack. An attacker can inject malicious script that will execute in the browsers of anyone who views the affected content, potentially leading to cookie theft, defacement, or redirection. The weakness lies in the failure to encode or escape user input before rendering it in the page, aligning with CWE‑79.

The vulnerability affects the Imran Emu:Owl Carousel WP WordPress plugin for all versions from any released version up to and including 2.2.2. The plugin can be installed on any WordPress website that includes it.

The CVSS score of 5.9 indicates a medium severity, while the EPSS score of less than 1% suggests that even though the flaw exists, it is not currently widely exploited. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector involves an attacker who can add or modify content through the plugin’s interface—typically someone with administrative or privileged access. The stored XSS payload would then be delivered to all visitors of the affected page, but exploitation requires success in the content entry phase.