Cross-Site Scripting Vulnerability in Carousel Horizontal Posts Content Slider by WordPress
CVE-2026-22347

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Carousel Horizontal Posts Content Slider
Vendor
CVE Published:
22 January 2026

What is CVE-2026-22347?

A Cross-Site Scripting (XSS) vulnerability exists in the Carousel Horizontal Posts Content Slider plugin for WordPress. This flaw allows an attacker to inject malicious scripts into the web page through improper input handling during the generation of the DOM. Any user interacting with the site may unknowingly execute these scripts, leading to exposure of sensitive information or further exploitation of user sessions. Users of the Carousel Horizontal Posts Content Slider plugin on versions prior to 3.3.2 are particularly at risk and should take immediate steps to mitigate this vulnerability.

Affected Version(s)

Carousel Horizontal Posts Content Slider 0 <= 3.3.2

References

https://patchstack.com/database/Wordpress/Plugin/carousel...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ | Patchstack Bug Bounty Program
.