Stored Cross-Site Scripting Vulnerability in Ultimate Multi Design Video Carousel for WordPress

CVE-2025-9372

What is CVE-2025-9372?

The Ultimate Multi Design Video Carousel plugin for WordPress is prone to Stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping processes. Attackers with editor-level access can exploit this flaw, allowing them to inject arbitrary web scripts into pages. These malicious scripts can execute whenever an unsuspecting user visits the affected pages. This vulnerability specifically impacts multi-site setups and installations with unfiltered_html disabled, highlighting the urgent need for updates to safeguard against potential exploits.

References