WP Posts Carousel

WP Posts Carousel has 5 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (80%). Other recurring categories include Deserialization Of Untrusted Data.

Every one of the 5 issues recorded for WP Posts Carousel has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by astra.r3verii. WP Posts Carousel is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Posts Carousel vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-39358

WP Posts Carousel <= 1.3.12 - Authenticated (Contributor+) PHP Object Injection

Read the full analysis

Vulnerability Records

5 records


2025-05-29 00:00	WP Posts Carousel <= 1.3.12 - Authenticated (Contributor+) PHP Object Injection WP Posts Carousel <= 1.3.12	`CVE-2025-39358`	8.8 High	astra.r3verii	Yes
2025-04-16 00:00	WP Posts Carousel <= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Posts Carousel <= 1.3.10	`CVE-2025-39573`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-03-28 00:00	WP Posts Carousel <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Posts Carousel <= 1.3.8	`CVE-2025-31094`	6.4 Medium	astra.r3verii	Yes
2025-03-27 00:00	WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Posts Carousel <= 1.3.7	`CVE-2025-30920`	6.4 Medium	Peter Thaleikis	Yes
2025-03-01 00:08	WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter WP Posts Carousel <= 1.3.7	`CVE-2025-1491`	6.4 Medium	Krzysztof Zając	Yes

Showing 1–5 of 5 reports

Latestv1.3.13

WP Posts Carousel

Author

teastudio.pl

4.6(27)

92/100

Last Updated

2025-05-15 (1y ago)

Active Installs

3,000+

Downloads

98,280

Requires WP

3.6+

Requires PHP

Tested up to

WP 6.7.7

Created

2015-05-05 (12y ago)

This plugin is under development, and we apologize for the lack of updates. The development is ongoing, and we are planning to release it in May 2025! 🚀 Stay tuned! WP Posts Carousel allows to view the list of selected post types in a carousel. The plugin offers rich parameters of carousel display and post information, and provides better support for mobile devices. The plugin is equipped with a code generator (allows to insert the carousel into content) and a dedicated widget. This plugin uses OWL Carousel in new version 2.0.0-beta.2.4. This plugin may require some others plugins or libraries: Font Awesome – this library is included but you can disable it on the plugin’s settings page WordPress Popular Posts – this plugin is required only if you want to display popular posts in the carousel Now available in the following Languages English (en_EN) Polish (pl_PL) If you need other translation or you would like to create some, please visit crowdin.com project page. For more information, check out PLUGIN HOMEPAGE. I will be grateful for opinions and reviews. Translations: English – by Marcin Gierada Polish – by Marcin Gierada

View on WordPress.org