Security vulnerability

HI,

I also manage a site with this plugin installed and activated. Do you have any idea when the vulnerability will be fixed and the plugin will be updated?

The Ultimate Carousel For WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ultimate-carousel-for-visual-composer/ultimate-carousel-for-wpbakery-page-builder-26-authenticated-contributor-stored-cross-site-scripting-via-shortcode

Hi there,
Here another notification about the same XSS vulnerability issue. When will this fix be available in a next update?

https://itsec-site-scanner.ithemes.com/vulnerability-details/djIubG9jYWwuQmk5emxBaUltSUstUW9la1ViRmpFb1pNdjhPOGlCNTRtMHNfY1drTVpvWXI5WF96Y0FPOV9LOXVnQXJRSnUtOXJ0cUpIMy1pdlFFWE9SMHc0dkJ6TG1Nb1RhekJucHhUUnJkQ29QTWVHVVRPV1BGX3BNYUVhbnZ2eTF1MkplUW5rNmhoU0hmbXJzXzh3UlZpZXZRSkwwcFBUTWd2WVZxbXZldHBGN3B2WnhQZG1UQTlyZERPM2pMekE2eWFzdnNqSy14Z19wOTVPTXlMNFlxOEVZdnEyRzVTVW9SQ1lXYW1NdmFiMHN1ZnhPRjNWaW9xWi1wODZyYU5mM0g0NkFMOGp4YUs5dFpFeEE1TWdCVFJFWGJodFp4SHItZHQ0OWpLQVJTVEJhRXFLMmNia1BwSlMyeHFqUF8tMWJpTmtaT2hRUkNITEVZZHhheDB2LWxVcGg5ZTRSUk5FblVvbEpMVm8tTVd4SzV3cnltc0VuQUgwMjA5RXdKd19hXzl0WnFzeE02bFBEY2xBb3lfTVlOcDhJdl9KNDZ6V1hDVQ%253D%253D#ps-11399

As far as I understand, you need to be a registered user to edit the shortcode. Therefore, only registered users can edit this. If only the necessary users have access to this and appropriate passwords are used the risk should be very low. Or did I miss anything?