The Post Grid, Slider & Carousel Ultimate plugin for WordPress has a security vulnerability in versions up to 1.6.6. This means that someone with at least contributor-level access can inject harmful web scripts into pages, which will run whenever someone visits that page.