CVE-2024-2949 in Carousel, Slider, Gallery Plugin
Summary
by MITRE • 04/06/2024
The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2949 affects the WP Carousel plugin for WordPress, specifically targeting the carousel widget functionality within versions up to and including 2.6.3. This represents a critical security flaw that enables stored cross-site scripting attacks, allowing malicious actors with contributor-level privileges or higher to inject persistent malicious scripts into the WordPress environment. The vulnerability stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate or sanitize user-supplied attributes before processing them within the carousel widget.
The technical implementation of this vulnerability occurs when authenticated users with contributor access or above submit malicious input through the carousel widget configuration parameters. These inputs are not adequately sanitized or escaped before being stored in the WordPress database and subsequently rendered in web pages. The flaw creates a persistent XSS vector where the injected scripts execute whenever any user accesses pages containing the compromised carousel content, making it particularly dangerous for environments where multiple users interact with the same content. This vulnerability aligns with CWE-79, which describes cross-site scripting flaws where insufficient input validation allows malicious scripts to be executed in the context of a victim's browser.
The operational impact of CVE-2024-2949 extends beyond simple script injection, as it provides attackers with the ability to perform various malicious activities including session hijacking, credential theft, and data exfiltration. Attackers can leverage this vulnerability to establish persistent access to the WordPress administration interface, potentially leading to complete system compromise. The low privilege requirement makes this vulnerability particularly concerning as it can be exploited by users who should normally have limited access rights, undermining the principle of least privilege. This weakness also impacts the integrity of the WordPress installation and can be used to deface websites or redirect users to malicious domains.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest version of the WP Carousel plugin where the XSS vulnerability has been addressed. The recommended approach involves applying the vendor-provided security patch that implements proper input sanitization and output escaping for all user-supplied attributes within the carousel widget. Additionally, administrators should consider implementing additional security measures such as restricting user privileges to prevent unauthorized access to plugin configuration interfaces and monitoring for suspicious activity in the WordPress admin area. The vulnerability demonstrates the importance of proper input validation and output escaping as outlined in the OWASP Top Ten and ATT&CK technique T1059.001 for command and scripting interpreters, where persistent XSS can be leveraged to establish more sophisticated attack vectors.