Executive Summary

The WP Carousel Free plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to 2.7.10. This happens because the plugin's fancybox-config.js script reads the carousel container's id attribute directly from the DOM without sanitizing it. If a Contributor-level user creates a carousel container with a malformed ID containing characters invalid for jQuery selectors, the custom fancybox configuration fails and throws a JavaScript error.

As a result, the fancybox library falls back to its default caption handling, which renders the data-caption attribute content as raw HTML. Since WordPress allows data-* attributes through wp_kses_post(), this enables authenticated attackers with Contributor-level access or higher to inject arbitrary scripts into pages. These scripts execute whenever a user clicks an image in the crafted carousel lightbox.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users with Contributor-level access or above to inject malicious scripts into WordPress pages via the carousel's data-caption attribute. These scripts execute when other users interact with the carousel images, potentially leading to unauthorized actions such as stealing session cookies, defacing content, or performing actions on behalf of other users.

Because the vulnerability involves stored cross-site scripting, the malicious code persists on the site and affects multiple users, increasing the risk and impact.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the WP Carousel Free plugin for WordPress versions up to 2.7.10 and is triggered by crafted fancybox data-caption attributes causing JavaScript errors and fallback to unsafe caption rendering.

Detection would involve checking if the vulnerable plugin version is installed and active on your WordPress site.

Since the vulnerability is triggered by malformed carousel container IDs and data-caption attributes, you can inspect the HTML source of pages using the carousel for suspicious or malformed data-caption attributes.

There are no specific commands provided in the available resources to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the WP Carousel Free plugin to a version later than 2.7.10 where this vulnerability is fixed.

If an update is not immediately available, restrict Contributor-level access or higher to trusted users only, as the vulnerability requires authenticated users with Contributor-level access or above to exploit.

Additionally, monitor and sanitize any carousel container IDs and data-caption attributes to prevent injection of malicious scripts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users with Contributor-level access to inject arbitrary web scripts via stored cross-site scripting (XSS) in the WP Carousel Free plugin. This could lead to unauthorized script execution when users interact with the carousel images.

Such unauthorized script execution can potentially lead to data exposure or manipulation, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal data and preventing unauthorized access.

However, the provided information does not explicitly detail the direct impact on compliance with these standards.

Useful 0 Not Useful 0