Carousel Slider Vulnerability – Authenticated (Editor+) Stored Cross-Site Scripting – CVE-2024-3703 | WordPress Plugin Vulnerability Report

Plugin Name: Carousel Slider

Key Information:

  • Software Type: Plugin
  • Software Slug: carousel-slider
  • Software Status: Active
  • Software Author: sayful
  • Software Downloads: 908,916
  • Active Installs: 40,000
  • Last Updated: April 25, 2024
  • Patched Versions: 2.2.10
  • Affected Versions: <= 2.2.9

Vulnerability Details:

  • Name: Carousel Slider <= 2.2.9
  • Title: Authenticated (Editor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-3703
  • CVSS Score: 4.4
  • Publicly Published: April 12, 2024
  • Researcher: Krugov Artyom
  • Description: The Carousel Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via slide options settings in all versions up to, and including, 2.2.9. This vulnerability is due to insufficient input sanitization and output escaping, allowing authenticated attackers with editor-level permissions and above to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page, specifically affecting multi-site installations and installations where unfiltered_html has been disabled.


The Carousel Slider for WordPress has a vulnerability in versions up to and including 2.2.9 that allows editor-level users to inject harmful scripts into web pages. This vulnerability has been patched in version 2.2.10.

Detailed Overview:

This Stored Cross-Site Scripting vulnerability was identified by security researcher Krugov Artyom. It is found within the slide options settings of the Carousel Slider, where inadequate security measures allow for the injection and execution of scripts. The vulnerability is particularly risky as it enables potential data leakage and unauthorized actions on behalf of the user, compromising site integrity and user trust. The developers have addressed these issues in the patched version, closing security gaps and enhancing plugin safeguards.

Advice for Users:

  • Immediate Action: Update to the patched version 2.2.10 immediately to mitigate risks.
  • Check for Signs of Vulnerability: Review your site for unexpected or strange behavior in Carousel Slider content areas.
  • Alternate Plugins: While a patch is available, consider using alternative plugins that offer similar functionality as a precaution.
  • Stay Updated: Always ensure that your plugins are updated to the latest versions to avoid vulnerabilities.


The prompt response from Carousel Slider developers in patching this vulnerability emphasizes the critical nature of maintaining up-to-date software. Users are advised to upgrade to version 2.2.10 or later to secure their WordPress installations against potential threats.


Detailed Report: 

In the digital age, the security of your website can be your stronghold or your Achilles' heel. Keeping your website and its components up-to-date is not merely a best practice; it is a necessary measure against the relentless advancement of cyber threats. This point is illustrated by a recent discovery of a critical vulnerability in the Carousel Slider plugin—a popular WordPress plugin that underscores the importance of regular updates and monitoring.

About the Plugin: Carousel Slider

Carousel Slider, developed by sayful, is a widely used WordPress plugin with over 40,000 active installs. It recently came under scrutiny due to a significant security issue identified in versions up to and including 2.2.9. The plugin was last updated on April 25, 2024, and a patched version, 2.2.10, has been released to address the newly discovered vulnerability.

Details of the Vulnerability

The vulnerability, cataloged under CVE-2024-3703, involves authenticated (Editor+) stored cross-site scripting (XSS). This type of attack allows individuals with editor-level access or higher to inject harmful scripts into web pages. These scripts execute whenever a user accesses an injected page, leading to potential unauthorized actions and data leakage, particularly affecting multi-site installations and installations where unfiltered_html has been disabled. The issue was publicly disclosed on April 12, 2024, by researcher Krugov Artyom.

Risks and Potential Impacts

This XSS vulnerability poses a significant risk as it can be exploited to manipulate web pages, steal sensitive information from users, or even gain unauthorized access to the admin portions of a WordPress site. The impact is heightened in environments that allow multiple users with editor-level permissions, underscoring the need for strict user role management and regular security audits.

Previous Vulnerabilities and Continuous Vigilance

Before this incident, there was one other reported vulnerability in Carousel Slider since September 5, 2023. This pattern suggests that while the plugin is generally reliable, vulnerabilities can emerge, particularly as attackers develop new techniques and as the complexity of software increases.

Conclusion: The Importance of Proactive Security Measures

For small business owners managing WordPress websites, staying on top of security updates can seem daunting. However, the risks of neglecting this aspect of website management can be severe. Engaging with a security service that can handle regular updates, perform security audits, and respond to incidents can reduce the burden. Remember, the cost of prevention is often much less than the cost of a security breach.

By investing in regular maintenance and security for your digital presence, you protect not only your business but also your customers' trust and safety.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Carousel Slider Vulnerability – Authenticated (Editor+) Stored Cross-Site Scripting – CVE-2024-3703 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment