CVE-2024-13331 — WP Dream Carousel <= 1.0.1b

Back Back to CVE browser

MEDIUM

WP Dream Carousel <= 1.0.1b - Reflected XSS

Published Feb 4, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.58%

Description

The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products

Vendor n/a Product WP Dream Carousel Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=1.0.1b

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WP Dream Carousel

affected

Version	Status	Constraints
0	affected	<=1.0.1b

Remediation

No remediation recorded yet.

Metrics

0.58% 0.00584

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00584

Score over time

2025–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.58% (0.00584)	45.96th	v5 (v2026.06.15)
Jun 15, 2026	0.56% (0.00561)	42.00th	v5 (v2026.06.15)
Mar 15, 2026	1.11% (0.01109)	77.91th	v4 (v2025.03.14)
Mar 17, 2025	0.03% (0.00034)	6.46th	v4 (v2025.03.14)
Feb 5, 2025	0.04% (0.00043)	11.49th	v3 (v2023.03.01)