CVE-2024-2949: 
WordPress vulnerability analysis and mitigation

The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in versions up to and including 2.6.3. The vulnerability was discovered and disclosed on April 6, 2024, affecting the carousel widget component (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the carousel widget component. The CVSS v3.1 score is 6.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires authentication with at least contributor-level access to exploit. Once authenticated, an attacker can inject malicious scripts through the carousel widget's user-supplied attributes (NVD).

Users should update to a version newer than 2.6.3 of the WP Carousel plugin to address this vulnerability (NVD).