The WP Carousel Free WordPress plugin suffers from a stored XSS vulnerability due to improper input neutralization in its fancybox configuration. Specifically, the plugin reads the carousel container's ID directly from the DOM to build a jQuery selector without sanitization. If a Contributor-level attacker crafts a malformed carousel container ID containing characters invalid for jQuery selectors, the fancybox configuration script throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to revert to default caption handling, which renders the data-caption attribute content as raw HTML. Since WordPress permits data-* attributes via wp_kses_post(), this allows injection of arbitrary scripts in pages, executing when users interact with the carousel lightbox images. The vulnerability affects all versions up to and including 2.7.10. No patch or official fix has been published as of the data provided.

An authenticated attacker with Contributor-level or higher privileges can inject arbitrary JavaScript code into pages containing the vulnerable carousel. This script executes in the context of users who view and interact with the carousel lightbox images, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality and integrity of user sessions. The CVSS score of 6.4 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required beyond clicking an image.

No official patch or remediation is currently available for this vulnerability. Since the vendor advisory or patch information is not provided, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level user privileges where possible and monitor for suspicious activity related to carousel usage. Avoid allowing untrusted users to create or edit carousel content. Consider disabling or replacing the plugin if feasible to mitigate risk.