Post Carousel Slider For Elementor Vulnerabilities

The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

5.4

Affected:

up to 1.7.0

Fix:

No patched version reported

Disclosed:

Sep 22, 2025

CVE-2025-57955 on NVD →

The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to tr...

CVSS:

4.3

Affected:

up to 1.6.0

Fixed in:

1.7.0

Disclosed:

Jun 25, 2025

CVE-2025-3863 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Post Carousel Slider for Elementor allows Stored XSS.This issue affects Post Carousel Slider for Elementor: from n/a through 1.4.0.

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

Dec 1, 2024

CVE-2024-53749 on NVD →

The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary we...

CVSS:

6.4

Affected:

up to 1.5.0

Fixed in:

1.6.0

Disclosed:

Nov 28, 2024

CVE-2024-53749 on NVD →

Affected:

up to 1.7.0

Fixed in:

1.7.0

CVE-2025-3863 on NVD →

Affected:

up to 1.7.0

Fix:

No patched version reported

CVE-2025-57955 on NVD →