CVE-2026-4665 MEDIUM

CVE-2026-4665: WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute

Vendor Shapedplugin
Product Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel
Weakness CWE-79 · XSS
Published May 5, 2026
Last update May 5, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's `id` attribute directly from the DOM to construct a jQuery selector without sanitization. When a Contributor crafts an HTML block with a malformed carousel container ID (containing characters invalid for jQuery selectors), the custom fancybox configuration throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to fall back to its default caption handling, which renders the `data-caption` attribute content as raw HTML. Since WordPress allows `data-*` attributes through `wp_kses_post()`, this makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks an image in the crafted carousel lightbox.

Explanation of Vulnerability in Simple Terms

02Summary

A cross-site scripting (XSS) vulnerability in WP Carousel versions up to 2.7.10 allows authenticated users to inject malicious scripts that execute in other users' browsers. The vulnerability has a changed scope, meaning the impact extends beyond the plugin itself to affect the broader site. An attacker with low-level WordPress access can craft malicious input that compromises site visitors' sessions or data.

What an attacker can do

03Attacker Capabilities

Inject JavaScript code that runs in other users' browsers and steals their session data or perform actions on their behalf.

Potential impact on your site

04Site Impact

Visitors and admins may have their sessions hijacked or be tricked into performing unwanted actions on the site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account (e.g., contributor or subscriber role with plugin access).

Key dates

06Disclosure timeline

May 5, 2026 CVE published
May 5, 2026 Record updated