Executive brief
Slider by Soliloquy, a popular WordPress plugin used to create image and video slideshows, contains a security flaw in version 2.6.2. An authorized user, such as a site contributor, can inject malicious scripts into the title field of a slider. These scripts automatically run in the browsers of other users, including site administrators, potentially leading to unauthorized actions or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Slider by Soliloquy version 2.6.2 due to improper neutralization of the 'title' parameter. An authenticated attacker with permissions to create or edit sliders can inject JavaScript payloads into the title field. Because the input is not properly sanitized before being stored and rendered, the malicious script executes in the context of any user viewing the slider on both the WordPress administrative dashboard and the public-facing frontend. This can be used to hijack administrative sessions or perform actions on behalf of other users. A proof-of-concept exploit has been publicly disclosed.
Affected products
- Soliloquywp Slider by Soliloquy 2.6.2
Timeline
- 2021-12-03: disclosed: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published