The DiviGear Carousel plugin for WordPress contains a flaw in its update_license AJAX action that allows an authenticated user with subscriber‑level access or higher to store unsanitized script data. When the stored license value is later displayed on the Activation settings page, it is echoed inside a single‑quoted HTML attribute without proper escaping. This results in arbitrary client‑side code execution whenever the affected page is rendered by a browser. The vulnerability is classified under CWE‑79 and can enable attackers to hijack user sessions, deface content, or deliver malware to site visitors.

Affected products include DiviGear Carousel for WordPress. All releases up to and including version 5.2.0 are vulnerable. No other affected versions are currently listed.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation is low, and the flaw is not currently listed in the CISA KEV catalog. The attack requires successful authentication as a subscriber or higher and an interaction with the Activation settings page. Attackers can deliver a payload through the AJAX action, which is then stored and later executed in the administrative context, providing a persistent cross-site scripting vector.