CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by Soliloquy allows Cross-Site Scripting (XSS).This issue affects Slider by Soliloquy: from n/a through 2.7.6.
Explanation of Vulnerability in Simple Terms
Slider by Soliloquy versions up to 2.7.6 contain a cross-site scripting (XSS) vulnerability that allows authenticated users with high privileges to inject malicious scripts. The vulnerability requires user interaction to trigger. An attacker with admin or editor access can craft a malicious slider configuration that executes JavaScript in the browsers of site visitors, potentially compromising user sessions or stealing data.
What an attacker can do
Inject and execute malicious JavaScript in visitor browsers through slider content.
Potential impact on your site
Compromised admin accounts can inject malicious code affecting all site visitors.
Conditions required to exploit
Admin or editor access to the site; victim must view the affected slider.
Key dates
External resources
Related vulnerabilities
