CVE-2025-1491 identifies a stored Cross-Site Scripting vulnerability in the WP Posts Carousel plugin for WordPress, specifically in versions up to and including 1.3.7. The vulnerability stems from insufficient sanitization and escaping of the 'auto_play_timeout' parameter, which is used during web page generation. Authenticated attackers with Contributor-level privileges or higher can exploit this flaw by injecting arbitrary JavaScript code into pages rendered by the plugin. Because the malicious script is stored persistently, it executes every time a user accesses the affected page, potentially compromising user sessions, stealing cookies, or performing unauthorized actions on behalf of users. The vulnerability does not require user interaction beyond visiting the injected page and does not require administrator privileges, increasing its risk profile. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction, and a scope change with low confidentiality and integrity impact but no availability impact. No patches or official fixes are currently listed, and no known exploits have been reported in the wild. The vulnerability is categorized under CWE-79, which covers improper neutralization of input during web page generation leading to XSS.

The exploitation of this vulnerability can lead to unauthorized script execution in the context of the affected website, potentially allowing attackers to hijack user sessions, deface websites, or perform actions on behalf of legitimate users. Since the attack requires only Contributor-level access, attackers who have compromised or registered such accounts can leverage this to escalate their impact. The persistent nature of stored XSS means that every visitor to the infected page is at risk, increasing the attack surface. This can damage organizational reputation, lead to data leakage, and facilitate further attacks such as phishing or malware distribution. Given WordPress's widespread use globally, organizations relying on the WP Posts Carousel plugin are at risk of targeted or opportunistic attacks, especially if they do not promptly address the vulnerability.

Organizations should immediately audit their WordPress installations for the presence of the WP Posts Carousel plugin and verify the version in use. Until an official patch is released, administrators should consider disabling or removing the plugin to eliminate exposure. If removal is not feasible, implement strict input validation and output encoding on the 'auto_play_timeout' parameter to neutralize malicious input. Restrict Contributor-level user permissions to trusted individuals only and monitor for unusual activity or unauthorized content injections. Employ Web Application Firewalls (WAFs) with rules to detect and block XSS payloads targeting this parameter. Regularly update WordPress and all plugins to their latest versions and subscribe to vendor advisories for timely patch releases. Conduct security awareness training for users with elevated privileges to reduce the risk of account compromise.