CVE-2026-4665: WP Carousel Free Plugin XSS Vulnerability

CVE-2026-4665 Overview

CVE-2026-4665 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Carousel Free plugin for WordPress, affecting all versions up to and including 2.7.10. The flaw resides in the fancybox-config.js script, which reads the carousel container's id attribute directly from the Document Object Model (DOM) to build a jQuery selector without sanitization. Authenticated users with Contributor-level access can craft a carousel container with a malformed id, forcing the plugin's custom configuration to throw a JavaScript error. The bundled fancybox library (v3.5.7) then falls back to default caption handling, which renders the data-caption attribute as raw HTML.

Critical Impact
Authenticated Contributors can store arbitrary JavaScript that executes in the browsers of any users who open the carousel lightbox, enabling session theft and content manipulation.

Affected Products

WP Carousel Free plugin for WordPress, all versions up to and including 2.7.10
Sites permitting Contributor-level (or higher) account registration
Pages embedding the plugin's carousel block with fancybox lightbox enabled

Discovery Timeline

2026-05-05 - CVE-2026-4665 published to the National Vulnerability Database (NVD)
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4665

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. The plugin's fancybox-config.js script initializes a custom fancybox configuration by reading the carousel container's id attribute and using it directly as a jQuery selector. jQuery selectors require specific character escaping rules, so an id containing characters such as unescaped brackets, quotes, or other selector metacharacters causes the selector parse to fail. When the custom initializer throws, fancybox v3.5.7 reverts to its default behavior. The default behavior renders the contents of data-caption as HTML rather than text. WordPress permits data-* attributes through wp_kses_post(), so a Contributor's saved post retains the attacker-controlled data-caption value verbatim.

Root Cause

The root cause is the unsanitized use of a DOM-derived value to construct a jQuery selector, combined with a fail-open error path. When the custom configuration fails to initialize, the library's default caption rendering treats data-caption content as raw HTML, bypassing the developer's intended safe rendering path.

Attack Vector

An authenticated attacker with Contributor-level access creates or edits a post containing an HTML block that includes a carousel container with a malformed id attribute and a data-caption attribute containing JavaScript payloads such as <img> tags with onerror handlers. After the post is published or previewed, any visitor who clicks an image in the carousel lightbox triggers fancybox's default caption rendering, executing the injected script in the visitor's browser session.

No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source for technical details.

Detection Methods for CVE-2026-4665

Indicators of Compromise

Posts authored by Contributor-level accounts containing carousel HTML blocks with unusual or malformed id attribute values
data-caption attribute values that include HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or <iframe>
JavaScript console errors referencing jQuery selector parse failures originating from fancybox-config.js
Outbound browser requests to unknown domains immediately after a visitor opens a carousel lightbox

Detection Strategies

Audit the WordPress posts and postmeta tables for carousel markup containing data-caption values with HTML angle brackets or event handler attributes
Inspect saved revisions from Contributor accounts for HTML blocks targeting the WP Carousel Free shortcode or block
Use Content Security Policy (CSP) violation reports to surface inline script execution on pages with the carousel

Monitoring Recommendations

Log and review all post submissions from Contributor and Author roles before publication
Monitor web server access logs for visitor sessions that load carousel pages followed by anomalous outbound requests
Alert on the creation or modification of posts containing the substring data-caption= with HTML metacharacters in the value

How to Mitigate CVE-2026-4665

Immediate Actions Required

Update WP Carousel Free to a version later than 2.7.10 that includes the fix from WordPress Changeset 3506878
Audit existing posts created or edited by Contributor-level users for malicious data-caption payloads
Restrict Contributor account registration on sites that do not require it, and review existing low-privilege accounts

Patch Information

The vendor addressed the issue in WordPress Changeset 3506878, which modifies public/js/fancybox.js to correctly handle the carousel container id and prevent the fallback path that renders data-caption as raw HTML. Site administrators should apply the latest plugin update from the WordPress plugin repository.

Workarounds

Temporarily deactivate the WP Carousel Free plugin until the patched version is installed
Remove or downgrade Contributor-level accounts that are not strictly necessary
Deploy a Web Application Firewall (WAF) rule that blocks post submissions containing data-caption attributes with HTML tags or event handler attributes
Enforce a strict Content Security Policy that disallows inline script execution on front-end pages

bash

# Configuration example: WP-CLI commands to inventory and update the plugin
wp plugin list --name=wp-carousel-free --fields=name,status,version
wp plugin update wp-carousel-free
wp user list --role=contributor --fields=ID,user_login,user_registered