The Splide Carousel Block plugin for WordPress is vulnerable because the ‘url’ attribute of the carousel item is stored without sufficient sanitization and is not escaped when rendered. Consequently, a user with contributor or higher privileges can insert a malicious payload into this attribute, which is then stored in the database and executed whenever a page that contains the carousel is viewed. This can lead to session hijacking, credential theft, or other client‑side attacks against visitors to the site. The vulnerability requires the attacker to create or edit a post using the carousel block; the payload must be published before it will run for other users.

The issue affects any installation of the Splide Carousel Block plugin from its initial release through version 1.7.1. All contributors, editors and administrators who can add or edit posts containing the carousel block are potentially able to exploit the flaw.

The CVSS score of 6.4 indicates moderate overall impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that it is not yet widely exploited in the wild. However, because the vulnerability requires only contributor‑level access—a role commonly granted to authoring users—any affected site with such users could be compromised. The attack path is straightforward: an authorized user creates a post, inserts the malicious payload into the carousel’s URL attribute, publishes the post, and then any visitor to that post will execute the script.