Is CVE-2026-4665 actively exploited?

No active exploitation of CVE-2026-4665 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4665 be exploited remotely?

Yes. CVE-2026-4665 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-4665?

CVE-2026-4665 has a CVSS score of 6.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-4665

MEDIUM

CVE-2026-4665

CWE-79Published: May 5, 2026· Updated: May 5, 2026

6.4

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.6th

Official Description

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox `data-caption` attributes in all versions up to, and including, 2.7.10. This is due to the `fancybox-config.js` script reading the carousel container's `id` attribute directly from the DOM to construct a jQuery selector without sanitization. When a Contributor crafts an HTML block with a malformed carousel container ID (containing characters invalid for jQuery selectors), the custom fancybox configuration throws a JavaScript error and fails to initialize. This causes the bundled fancybox library (v3.5.7) to fall back to its default caption handling, which renders the `data-caption` attribute content as raw HTML. Since WordPress allows `data-*` attributes through `wp_kses_post()`, this makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks an image in the crafted carousel lightbox.

NVD Source

Technical Analysis

CVE-2026-4665 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.