Multi Post Carousel By Category
Monthly
The Multi Post Carousel by Category WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'slides' shortcode attribute due to insufficient input sanitization and output escaping in the post_slides_shortcode function. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript code into pages, and the malicious script will execute whenever any user visits the affected page. With a CVSS score of 6.4 and confirmed vulnerability across all versions up to and including 1.4, this represents a moderate-risk vulnerability primarily affecting WordPress sites using this plugin.
The Multi Post Carousel by Category WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'slides' shortcode attribute due to insufficient input sanitization and output escaping in the post_slides_shortcode function. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript code into pages, and the malicious script will execute whenever any user visits the affected page. With a CVSS score of 6.4 and confirmed vulnerability across all versions up to and including 1.4, this represents a moderate-risk vulnerability primarily affecting WordPress sites using this plugin.