CVE-2025-4567

MEDIUM

Post Slider and Post Carousel Widget < 3.2.10 - Stored XSS via Widget Options

Title source: llm
STIX 2.1

Description

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/b8a50ae9-40c4-42f8-9342-2440d3bc12bb/

Scores

CVSS v3 4.8
EPSS 0.0021
EPSS Percentile 11.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
infornweb/post_slider_and_post_carousel < 3.2.10
Published Jun 03, 2025
Tracked Since Feb 18, 2026