CVE-2026-4665: shapedplugin carousel, slider, photo gallery with lightbox, video slider, by wp carousel Cross-site Scripting

Vulnerability summary

CVE-2026-4665 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in shapedplugin carousel, slider, photo gallery with lightbox, video slider, by wp carousel. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 25% of scored vulnerabilities. Fixed in 2.7.11.

Timeline

1. 05-05-2026
   PublishedVulnerability first disclosed.
2. 05-05-2026
   Last modifiedVulnerability information updated.

Description

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's `id` attribute directly from the DOM to construct a jQuery selector without sanitization. When a Contributor crafts an HTML block with a malformed carousel container ID (containing characters invalid for jQuery selectors), the custom fancybox configuration throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to fall back to its default caption handling, which renders the `data-caption` attribute content as raw HTML. Since WordPress allows `data-*` attributes through `wp_kses_post()`, this makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks an image in the crafted carousel lightbox.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.