Threats tagged 'ghsa-25qx-prpj-p4hq'

The WP Carousel Free plugin for WordPress up to version 2.7.10 contains a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin's fancybox configuration script reads the carousel container's ID attribute without sanitization, causing a fallback to unsafe caption rendering. Authenticated users with Contributor-level access or higher can inject malicious scripts via crafted data-caption attributes, which execute when users click images in the carousel lightbox.