Slider by Soliloquy 2.6.2 allows an authenticated user to inject JavaScript into the slider title. The content is stored and later rendered on both the administrative dashboard and the public website. Attacker controlled scripts run in the context of the visitor’s browser, giving them access to session cookies, the ability to deface content or redirect to malicious sites. This is a classic stored XSS flaw that can compromise confidentiality, integrity, and availability of the site.

The vulnerability affects the Soliloquy plugin for WordPress, specifically version 2.6.2. No other affected versions are listed in the public data. Systems running this version with authenticated user accounts are vulnerable.

The CVSS score of 5.1 indicates medium severity, and the absence of an EPSS score suggests no public exploit evidence yet. The flaw is not listed in CISA’s KEV catalog, meaning it is not known to be actively exploited at this time. The victim must be logged in as an author or higher and must have access to create or edit sliders in order to exploit it; however once the payload is stored, any visitor who loads a page containing the slider will execute the payload. Thus the attack vector is authenticated input leading to stored code executed during page rendering.