Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's `id` attribute directly from the DOM to construct a jQuery selector without sanitization. When a Contributor crafts an HTML block with a malformed carousel container ID (containing characters invalid for jQuery selectors), the custom fancybox configuration throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to fall back to its default caption handling, which renders the `data-caption` attribute content as raw HTML. Since WordPress allows `data-*` attributes through `wp_kses_post()`, this makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks an image in the crafted carousel lightbox.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚡ New CVE Alert: CVE-2026-4665 📊 Severity: 6.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4665 #CVE-2026-4665 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/NOL5NhoTEj
Post summary
The tweet announces CVE-2026-4665, a medium‑severity vulnerability affecting WordPress, without offering technical details, PoC, or exploit information.
CVE-2026-4665 Stored Cross-Site Scripting in WP Carousel Free Plugin Versions Up to 2.7.10 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4665
Post summary
The text announces CVE-2026-4665 as a stored XSS flaw in WP Carousel Free plugin up to version 2.7.10, providing technical details but no PoC, exploit, active use, patch or false‑positive claim.