What’s Vulnerable › Vulnerabilities

CVE-2025-4567: Post Slider and Carousel with Widget < 3.2.10 - Admin+ Stored XSS

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-03 · updated 2026-06-17
• Weakness: CWE-79

Description

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products

• Post Slider and Post Carousel with Post Vertical Scrolling Widget: before 3.2.10 — fixed in 3.2.10

How to fix

Upgrade to a fixed version: Post Slider and Post Carousel with Post Vertical Scrolling Widget 3.2.10. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/b8a50ae9-40c4-42f8-9342-2440d3bc12bb/
• https://wpscan.com/vulnerability/b8a50ae9-40c4-42f8-9342-2440d3bc12bb/

Get alerted when CVE-2025-4567 or the next vulnerability affects your stack