Vulnerable versions of the Slider Bootstrap Carousel plugin allow authenticated users with contributor-level privileges to exploit insufficient sanitisation of shortcode attributes. By inserting crafted values into the 'category' and 'template' attributes, an attacker can embed arbitrary JavaScript that is injected into various HTML attributes (id, data‑target, href, class). Because the input is stored in the database and rendered unchanged whenever a page containing the shortcode is loaded, the injected code runs for any visitor of that page, leading to potential data theft or session hijacking.

The flaw affects the Slider Bootstrap Carousel WordPress plugin created by felipermendes. All releases up to and including version 1.0.7 are vulnerable. The infection vector requires the user to have at least Contributor role or higher, and the malicious shortcode must be inserted into a page, post, or widget that is served by a site using one of the affected plugin versions.

The CVSS base score of 6.4 indicates moderate severity, with no exploitation probability data in EPSS and the vulnerability not listed in the CISA KEV catalog. Nonetheless, because the flaw relies on stored user input that runs in the browsers of every visitor to affected pages, the potential damage is high. An attacker needs only Contributor access, which is commonly granted to content authors. Once the malicious content is published, it executes automatically, making this vulnerability a significant risk for sites that rely on the plugin.