Carousel – Image Carousel, Post Slider, Product & Video Gallery
Carousel – Image Carousel, Post Slider, Product & Video Gallery has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Carousel – Image Carousel, Post Slider, Product & Video Gallery has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Carousel – Image Carousel, Post Slider, Product & Video Gallery is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-58652Carousel Ultimate <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Carousel – Image Carousel, Post Slider, Product & Video Gallery
Author
Themepoints
Carousel is a lightweight, responsive, and developer-friendly WordPress carousel plugin built to create high-converting image sliders, blog post carousels, video showcases, and WooCommerce product galleries. Re-engineered from the ground up in version 2.0.0, Carousel utilizes modern PHP architecture to deliver maximum performance, optimized CSS/JS enqueuing, and zero Cumulative Layout Shift (CLS). Whether you are building a simple brand logo carousel, a portfolio showcase, or a dynamic blog post slider, Carousel gives you full control over layout, responsiveness, and autoplay settings without slowing down your website. 🚀 Key Free Features Unlimited Images & Slides: Add as many slides, images, and captions as you need—no artificial limits on the free version. Custom Image Carousel: Easily create image sliders with drag-and-drop ordering, custom links, and lightbox previews. Dynamic Post Slider: Display recent posts, filter by categories, and toggle post titles, dates, authors, excerpts, and “Read More” buttons. Video Carousel: Embed responsive YouTube, Vimeo, and self-hosted MP4 videos inside your sliders. WooCommerce Product Carousel: Display featured, top-rated, on-sale, or category-specific products with live “Add to Cart” buttons. Zero Cumulative Layout Shift (CLS): Pre-calculated aspect ratios keep your site layout stable during page loads. Smart Asset Loading: Enqueues scripts and stylesheets only when a carousel or shortcode is actively present on the page. Full Responsive Breakpoints: Custom controls for columns and spacing across Desktop, Tablet, and Mobile devices. Page Builder Ready: Seamlessly works with Gutenberg blocks, Elementor, Divi, Beaver Builder, and classic shortcodes. Touch & Drag Enabled: Smooth touch-swipe navigation optimized for mobile devices and tablets. Customizable Controls: Toggle autoplay, autoplay speed, hover pause, infinite loop, navigation arrows, pagination dots, and slide transition effects. 💎 Pro Features Upgrade to Carousel Pro to unlock advanced layouts, multimedia support, and dynamic ecommerce integrations: * Standard Grid & Masonry Layouts: Switch seamlessly between smooth sliders, structured grids, and fluid masonry layouts. * Content Overlay Design Style: Display title, meta, and button content as modern hover overlays on top of images.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C