--- title: "ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/shapedplugin/carousel-slider-photo-gallery-with-lightbox-video-slider-by-wp-carousel type: product description: "ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel has 4 published CVEs, 0 in CISA KEV and 0 with public exploits." updated: 2026-05-05 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel vulnerabilities Vendor: [ShapedPlugin](https://radicalnotion.ai/vendor/shapedplugin) - **Published CVEs:** 4 - **In CISA KEV:** 0 - **With a public exploit:** 0 - **With a patch:** 4 - **Average CVSS:** 6.6 - **First CVE:** 2024-04-06 - **Latest CVE:** 2026-05-05 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 1 | | Medium | 3 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation | 3 | | [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2024 | 3 | | 2025 | 0 | | 2026 | 1 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \<= 2.6.3 | range | 2 | | \<= 2.6.8 | range | 1 | | \<= 2.7.10 | range | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-4665 | WP Carousel Free \<= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute | medium | 6.4 | No | No | Yes | | CVE-2024-5020 | Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library | medium | 6.4 | No | No | Yes | | CVE-2024-3020 | Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce \<= 2.6.3 - Authenticated (Admin+) PHP Object Injection | high | 7.2 | No | No | Yes | | CVE-2024-2949 | Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp\_wp\_carousel\_shortcode' | medium | 6.4 | No | No | Yes | ## Frequently asked questions ### How many CVEs does ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel have? ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel has 4 published CVE records since 2024. ### How many ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel CVEs are in CISA KEV? None of ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel vulnerabilities? No ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel CVEs currently have a tracked public exploit in this dataset. ### Which versions of ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel are affected? 3 distinct ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel CVEs? ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-502 (Deserialization of Untrusted Data). ### What is the average severity of ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel CVEs? The average CVSS base score across ShapedPlugin Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel's scored CVEs is 6.6. ## Other products from this vendor - [WP Tabs](https://radicalnotion.ai/vendor/shapedplugin/wp-tabs) (5 CVEs) - [product slider for woocommerce](https://radicalnotion.ai/vendor/shapedplugin/product-slider-for-woocommerce) (4 CVEs) - [logo carousel](https://radicalnotion.ai/vendor/shapedplugin/logo-carousel) (3 CVEs) - [Real Testimonials](https://radicalnotion.ai/vendor/shapedplugin/real-testimonials) (3 CVEs) - [Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials](https://radicalnotion.ai/vendor/shapedplugin/real-testimonials-testimonial-slider-collect-customer-reviews-and-video-testimonials) (3 CVEs) - [smart post show](https://radicalnotion.ai/vendor/shapedplugin/smart-post-show) (3 CVEs) - [Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ](https://radicalnotion.ai/vendor/shapedplugin/easy-accordion-ai-powered-faq-and-accordion-blocks-product-faq) (2 CVEs) - [Location Weather](https://radicalnotion.ai/vendor/shapedplugin/location-weather) (2 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/shapedplugin/carousel-slider-photo-gallery-with-lightbox-video-slider-by-wp-carousel). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.