The Post Grid, Slider & Carousel Ultimate WordPress plugin before version 1.8.1 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, one of its custom post type settings is not sanitized or escaped before being output in an HTML attribute on the admin edit screen. This enables users with Contributor or higher privileges to inject arbitrary JavaScript, which executes in the session of administrators who open the affected post item. This vulnerability can lead to session hijacking or other malicious actions performed with administrator privileges.

An attacker with Contributor or higher privileges can inject JavaScript code that executes in the administrator's browser session when they open the affected post item. This can lead to unauthorized actions performed with administrator privileges, including potential session hijacking or other malicious activities within the WordPress admin interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role users from accessing the affected plugin features or monitor for suspicious activity. Avoid opening affected items in the admin interface by administrators unless necessary and ensure strict role management.