Custom Links In Elementor Image Carousel
Monthly
Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.
Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.