This vulnerability (CVE-2026-65534) is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as cross-site scripting (XSS). It affects the Custom links functionality in the Elementor Image Carousel plugin developed by Charlie Etienne, specifically in versions up to 1.1.1. The issue allows an author-level user to inject malicious scripts via crafted input, which could lead to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 5.9, indicating medium severity, with attack vector network, low attack complexity, required privileges at the author level, user interaction required, and scope changed. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation could allow an attacker with author privileges to execute arbitrary scripts in the context of the affected web application. This may lead to partial loss of confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and author-level privileges, limiting the attacker's capabilities to some extent. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor for vendor updates. Until a patch is available, restrict author-level privileges to trusted users and consider disabling or limiting the use of the affected Custom links feature if feasible.