CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages.
Explanation of Vulnerability in Simple Terms
Slider by Soliloquy contains a cross-site scripting (XSS) vulnerability in version 2.6.2. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they interact with the slider. The vulnerability requires user interaction to trigger. Update to a version newer than 2.6.2.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view or interact with the slider.
Potential impact on your site
Site visitors' sessions could be compromised or malicious content injected into pages displaying the slider.
Conditions required to exploit
Attacker needs low-level site access (e.g., contributor or subscriber role) and the victim must view the affected slider.
Key dates
External resources
Related vulnerabilities
