CVE-2025-30920: WP Posts Carousel Stored XSS Vulnerability

CVE-2025-30920 Overview

CVE-2025-30920 is a stored cross-site scripting (XSS) vulnerability in the teastudio.pl WP Posts Carousel plugin for WordPress. The flaw affects all versions up to and including 1.3.7. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers with low privileges to inject persistent JavaScript payloads. Stored payloads execute in the browsers of site visitors and administrators who view affected pages. The vulnerability is tracked under CWE-79 and requires user interaction to trigger. Patchstack coordinated disclosure of the issue through its WordPress vulnerability program.

Critical Impact
Authenticated attackers can inject persistent JavaScript that runs in visitor and administrator browsers, enabling session theft, content defacement, and administrative account takeover through scope-changed execution.

Affected Products

teastudio.pl WP Posts Carousel plugin for WordPress
All versions from n/a through 1.3.7
WordPress sites with the wp-posts-carousel plugin installed and activated

Discovery Timeline

2025-03-27 - CVE-2025-30920 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30920

Vulnerability Analysis

The WP Posts Carousel plugin renders carousel content generated from plugin configuration fields and post metadata. The plugin does not apply proper output encoding or input sanitization to values supplied by authenticated users. An attacker with contributor-level or similar privileges can inject HTML and JavaScript into carousel-related parameters. The malicious payload is stored in the WordPress database and executes when any user renders the page containing the carousel.

The scope change reflected in the vulnerability metrics indicates that the injected script executes in a different security context than the vulnerable component. This behavior is consistent with browser-side execution against arbitrary site visitors, including administrators. Successful exploitation can lead to session cookie theft, forced administrative actions, and phishing content injection within the trusted domain.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Input passed through plugin-controlled fields is not sanitized on write via functions such as wp_kses_post() and is not escaped on output via esc_html(), esc_attr(), or esc_url(). As a result, HTML tags and event handlers persist in stored data and reach the DOM unchanged.

Attack Vector

Exploitation requires an authenticated user with permission to configure or contribute carousel content. The attacker submits carousel data containing an HTML payload with embedded JavaScript, for example an <img> tag with an onerror handler or a <script> block. The payload is written to the database and rendered whenever the carousel is displayed. Victims must load a page containing the vulnerable carousel for the script to execute, satisfying the user interaction requirement.

No verified public exploit code is available. Refer to the Patchstack advisory for WP Posts Carousel for coordinated disclosure details.

Detection Methods for CVE-2025-30920

Indicators of Compromise

Carousel configuration entries or post metadata containing <script>, onerror=, onload=, or javascript: patterns
Unexpected outbound requests from administrator sessions to attacker-controlled domains shortly after viewing pages with WP Posts Carousel content
New or modified WordPress administrator accounts created without an authorized change record
Web server access logs showing repeated POST requests to wp-admin/admin.php or wp-admin/post.php from low-privileged accounts modifying carousel content

Detection Strategies

Query the wp_options and wp_postmeta tables for stored HTML event handlers or <script> tags within fields written by the wp-posts-carousel plugin
Enable a Content Security Policy in report-only mode and monitor violation reports for inline script executions on pages rendering carousels
Correlate WordPress user activity logs with modifications to carousel-related post types and settings by non-administrative accounts

Monitoring Recommendations

Alert on creation or modification of WordPress users with administrator role following contributor or author activity
Monitor browser telemetry from administrative endpoints for anomalous cross-origin requests originating from the WordPress admin domain
Track plugin version metadata across managed WordPress installations to flag any host still running wp-posts-carousel version 1.3.7 or earlier

How to Mitigate CVE-2025-30920

Immediate Actions Required

Identify all WordPress installations running the WP Posts Carousel plugin and confirm the installed version
Deactivate the wp-posts-carousel plugin on affected sites until a patched version is available and verified
Audit existing carousel configuration data for previously injected HTML or JavaScript and remove malicious content
Force password resets and session invalidation for all administrator accounts if stored payloads are found

Patch Information

At the time of NVD publication, the advisory records affected versions from n/a through 1.3.7. Consult the Patchstack advisory for WP Posts Carousel and the plugin vendor page for the latest fixed release. Apply the vendor-supplied update as soon as it is verified in a staging environment.

Workarounds

Restrict contributor, author, and editor account creation and review the trust level of existing low-privileged users
Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in requests targeting wp-posts-carousel administrative endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Remove the plugin entirely if carousel functionality is not required by the site

bash

# Example WordPress CLI commands to inventory and disable the plugin
wp plugin list --name=wp-posts-carousel --fields=name,status,version
wp plugin deactivate wp-posts-carousel
wp plugin update wp-posts-carousel