CVE-2025-30920: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in teastudio.pl WP Posts Carousel plugin versions through 1.3.7. The vulnerability was discovered by Peter Thaleikis and was publicly disclosed on March 27, 2025. This security issue affects WordPress installations using the WP Posts Carousel plugin (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) issue. It has been assigned a CVSS v3.1 Base Score of 6.5 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked as CWE-79 and requires contributor-level privileges to exploit (NVD, Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability has been patched in version 1.3.8 of the WP Posts Carousel plugin. Users are advised to update to this version or later to remove the vulnerability. For users unable to update immediately, no alternative workarounds have been provided (Patchstack).