WordPress WP Posts Carousel plugin <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via autoplaytimeout Parameter vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Posts Carousel versions = 1.3.7...

PT-2025-9176

Name of the Vulnerable Software and Affected Versions WP Posts Carousel plugin for WordPress versions up to and including 1.3.7 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...