Plugin icon

Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel

wp-carousel-free

Vulnerabilities:

7

Last Updated:

August 18, 2026

Active Installs:

70000

Published
Title
Fixed in
CVSS
Published
2026-05-04
Title
WP Carousel Free < 2.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute
Fixed in
Fixed in 2.7.11
CVSS
5.5 (medium)
Published
2025-01-31
Title
Carousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSS
Fixed in
Fixed in 2.7.4
CVSS
3.5 (low)
Published
2024-12-03
Title
Multiple Plugins - Contributor+ DOM-Based Stored XSS via FancyBox JavaScript Library
Fixed in
Fixed in 2.6.9
CVSS
5.9 (medium)
Published
2024-04-09
Title
Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce < 2.6.4 - Authenticated (Admin+) PHP Object Injection
Fixed in
Fixed in 2.6.4
CVSS
7.2 (high)
Published
2024-04-05
Title
Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'
Fixed in
Fixed in 2.6.4
CVSS
6.4 (medium)
Published
2024-04-04
Title
Carousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSS
Fixed in
Fixed in 2.6.9
CVSS
3.5 (low)
Published
2022-12-22
Title
Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.5.3
CVSS
6.8 (medium)