The Diba carousel slider module fails to sanitize user input before rendering it in web pages, permitting stored XSS. An attacker who can add or edit slider items can inject JavaScript that then runs in the browsers of any visitor that loads the slider, potentially allowing session hijacking, defacement, or malware delivery.

The vulnerability affects Drupal’s Diba carousel slider module across all versions from 0.0.0 through 3.0.2. The module is present in any Drupal installation that includes the slider block and permits content editors to create or modify slider items.

The EPSS score is <1% and the issue is not listed in CISA KEV, but stored XSS offers a low‑barrier attack path for users with editing privileges. The CVSS score is 4.6. Based on the description, it is inferred that the likely attack vector requires an attacker to add or edit slider content to inject malicious script, after which every site visitor is exposed. The moderate impact on confidentiality, integrity, and availability of user sessions makes this a moderate risk for sites that rely on the slider.