CVE-2025-68548

This is a CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability. The Responsive Posts Carousel Pro plugin, a WordPress extension that displays posts in carousel format, fails to properly sanitize or escape user-supplied input before rendering it in HTML responses. Stored XSS vulnerabilities are more dangerous than reflected variants because the malicious payload persists in the application's database and executes for all subsequent visitors who view the affected content. WordPress plugins operate within the wp-admin and frontend contexts with direct database and rendering access, making input validation critical. The vulnerability likely exists in carousel configuration fields, post metadata, or display settings where user input is accepted but not properly escaped using WordPress sanitization functions (such as sanitize_text_field, wp_kses_post, or esc_html).