The SP Blog Designer WordPress plugin contains a flaw where the design attribute of the wpsbd_post_carousel shortcode is stored without proper sanitization, allowing an attacker with Contributor or higher privileges to inject arbitrary scripts into carousel pages. This is a CWE‑79 stored XSS vulnerability that enables malicious code execution on pages viewed by any site visitor.

All releases of SoftPulse Infotech’s SP Blog Designer plugin up to and including version 1.0.0 are affected. Sites that have installed the plugin and grant Contributor or higher users the right to edit carousel shortcodes are vulnerable.

The CVSS score of 6.4 reflects a moderate severity according to the CVSS v3.1 base metrics. Because the vulnerability is stored and requires authenticated access with Contributor or higher role, an attacker must first have such permissions on the site. Once a script is injected, it executes in the browsers of anyone who views that page. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Any site that allows contributors to edit carousel shortcodes is vulnerable and should act promptly.