CVE-2021-47922
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Slider by Soliloquy 2.6.2 contains a stored XSS vulnerability allowing authenticated attackers to inject malicious scripts via the title parameter. Scripts execute in browsers of users viewing the slider on both admin and frontend pages.
Risk Assessment
Attackers can hijack admin or regular user accounts, steal data, or spread malicious content.
Recommendation
Update the Slider by Soliloquy plugin to the latest version. Restrict slider editing privileges to trusted users only.
Original NVD description (English source)
Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages.