CVE-2026-4665 — Cross-Site Scripting (XSS)

title: CVE-2026-4665 - WP Carousel Free Stored XSS via crafted data-caption
id: scw-2026-05-05-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-4665 by observing web requests that include the WP Carousel Free plugin path and reference a 'data-caption' attribute in the referer, which is used in the exploit to inject malicious JavaScript. This rule targets the specific mechanism of the vulnerability where the fancybox library falls back to rendering raw HTML from the data-caption attribute due to a malformed carousel container ID.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-4665/
tags:
  - attack.initial_access
  - attack.t1189
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-content/plugins/wp-carousel-free/'
      cs-uri-query|contains:
          - 'fancybox-config.js'
      referer|contains:
          - 'data-caption='
      cs-method:
          - 'GET'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse