The Ultimate Multi Design Video Carousel plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in versions up to 1.4. Authenticated users with editor-level access can inject arbitrary web scripts due to inadequate input sanitization and output escaping. This vulnerability manifests in multi-site environments or installations with unfiltered_html disabled, enabling persistent script injection that executes when users view the affected pages. The CVSS 3.1 base score is 5.5, reflecting medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker with editor-level privileges can exploit this vulnerability to inject persistent malicious scripts into pages. These scripts execute in the context of users viewing the compromised pages, potentially leading to unauthorized actions or data exposure limited to confidentiality and integrity impacts. The vulnerability does not affect availability. It specifically affects multi-site WordPress installations or those with unfiltered_html disabled. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only, especially on multi-site installations or where unfiltered_html is disabled. Monitor for updates from gbsdeveloper regarding patches or security updates for this plugin.