This vulnerability in Themepoints Carousel Ultimate (<= 1.8) involves improper input neutralization during web page generation, leading to stored cross-site scripting (XSS). An attacker with high privileges and user interaction can inject malicious scripts that affect confidentiality, integrity, and availability to a limited extent. The vulnerability is network exploitable and affects the confidentiality, integrity, and availability of the affected system at a low to medium impact level.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of availability. The impact is rated medium based on the CVSS score of 5.9, reflecting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege user access and avoid interacting with untrusted inputs in the Carousel Ultimate plugin. Monitor for vendor updates regarding patches or official mitigations.