cleantalk
Vulnerabilities and Security Researches

Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Car, CVE-2024-4002

CVE, Research URL

CVE-2024-4002

Home page URL

Security reports for Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Car

Application

Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Car

Published on
May 16, 2025
Research Description
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions
max 2.6.9.
Status
vulnerable
Previous vulnerability researches
Easy Invoice – Invoice for WordPress, PDF Invoice, Quote for WordPress, WordPress Invoice Plugin (CVE-2025-6324) , Apr 25, 2026
Easy Invoice – Invoice for WordPress, PDF Invoice, Quote for WordPress, WordPress Invoice Plugin (CVE-2025-66115) , Dec 11, 2025
New vulnerability
MaxiBlocks Free Page Builder & Template Library (CVE-2026-2028) , Apr 26, 2026
WordPress Books Gallery (CVE-2026-5347) , Apr 26, 2026
LMS by Masteriyo – WordPress Learning Management System, eLearning Platform, Online Education System & Online Course (CVE-2026-39524) , Apr 26, 2026
Newsletter – Send awesome emails from WordPress (CVE-2025-3582) , Apr 26, 2026
Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Car (CVE-2024-4002) , Apr 26, 2026