CVE-2026-4665
Stored XSS in WP Carousel Free WordPress Plugin
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_carousel | wp_carousel_free | to 2.7.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the WP Carousel Free plugin for WordPress versions up to 2.7.10 and is triggered by crafted fancybox data-caption attributes causing JavaScript errors and fallback to unsafe caption rendering.
Detection would involve checking if the vulnerable plugin version is installed and active on your WordPress site.
Since the vulnerability is triggered by malformed carousel container IDs and data-caption attributes, you can inspect the HTML source of pages using the carousel for suspicious or malformed data-caption attributes.
There are no specific commands provided in the available resources to detect this vulnerability on your network or system.
Can you explain this vulnerability to me?
The WP Carousel Free plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to 2.7.10. This happens because the plugin's fancybox-config.js script reads the carousel container's id attribute directly from the DOM without sanitizing it. If a Contributor-level user creates a carousel container with a malformed ID containing characters invalid for jQuery selectors, the custom fancybox configuration fails and throws a JavaScript error.
As a result, the fancybox library falls back to its default caption handling, which renders the data-caption attribute content as raw HTML. Since WordPress allows data-* attributes through wp_kses_post(), this enables authenticated attackers with Contributor-level access or higher to inject arbitrary scripts into pages. These scripts execute whenever a user clicks an image in the crafted carousel lightbox.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with Contributor-level access or above to inject malicious scripts into WordPress pages via the carousel's data-caption attribute. These scripts execute when other users interact with the carousel images, potentially leading to unauthorized actions such as stealing session cookies, defacing content, or performing actions on behalf of other users.
Because the vulnerability involves stored cross-site scripting, the malicious code persists on the site and affects multiple users, increasing the risk and impact.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users with Contributor-level access to inject arbitrary web scripts via stored cross-site scripting (XSS) in the WP Carousel Free plugin. This could lead to unauthorized script execution when users interact with the carousel images.
Such unauthorized script execution can potentially lead to data exposure or manipulation, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal data and preventing unauthorized access.
However, the provided information does not explicitly detail the direct impact on compliance with these standards.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the WP Carousel Free plugin to a version later than 2.7.10 where this vulnerability is fixed.
If an update is not immediately available, restrict Contributor-level access or higher to trusted users only, as the vulnerability requires authenticated users with Contributor-level access or above to exploit.
Additionally, monitor and sanitize any carousel container IDs and data-caption attributes to prevent injection of malicious scripts.