Medium · 5.9 CVE-2026-22388 EUVD-2026-3854GHSA-9fcm-hxf8-v4x6

WordPress Owl Carousel WP plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Published Jan 22, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Imran Emu Product: Owl Carousel WP

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored XSS.This issue affects Owl Carousel WP: from n/a through <= 2.2.2.

Affected products

Vendor	Product	Affected	Fixed
Imran Emu	Owl Carousel WP	≤ 2.2.2	—

References

https://patchstack.com/database/Wordpress/Plugin/owl-carousel-wp/vulnerability/wordpress-owl-carousel-wp-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry