The WP Carousel Free plugin allows an authenticated user with Contributor or higher privileges to craft a carousel block that contains a malformed ID for the container. The plugin’s JavaScript reads that ID directly from the DOM without sanitization, building a jQuery selector that fails and causes FancyBox v3.5.7 to fall back to its default caption handling. Because WordPress permits data‑attributes through wp_kses_post(), the raw HTML supplied in the data-caption attribute is rendered unescaped when a user opens an image in the lightbox, allowing the attacker to inject and execute arbitrary scripts. This stored Cross‑Site Script defect can compromise the confidentiality and integrity of the website from the perspective of any visitor who interacts with the compromised carousel.

Users running WP Carousel Free (Carousel, Slider, Photo Gallery with Lightbox, Video Slider) by WP Carousel on WordPress sites with any version up to and including 2.7.10 are affected. Updated releases beyond 2.7.10 are presumed fixed.

The vulnerability has a CVSS score of 6.4, indicating a moderate level of risk. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified from the available metrics, but the weakness is not listed in the CISA KEV catalog. Attackers must possess at least Contributor role access and the ability to edit or add content to trigger the flaw. Successful exploitation results in arbitrary JavaScript execution in the context of the site’s front‑end whenever a user clicks a carousel image, potentially leading to data theft or session hijacking.