Is CVE-2021-47981 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47981 being exploited in the wild.

How severe is CVE-2021-47981?

Medium severity, with a CVSS score of 5.4, published 16 May 2026.

Is there a fix for CVE-2021-47981?

A patch was published on 2025-04-24: Vendor released version 6.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-47981 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-47981?

Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47981: OpenSolution Quick.CMS XSS in sliders form

CVE-2021-47981 · Severity: medium · CVSS 5.4 · Published 2026-05-16

Quick.CMS, a content management system used for building websites, contains a security flaw in its administrative slider management tool. An attacker can trick a logged-in administrator into clicking a malicious link, which then executes unauthorized code in their browser. This could allow the attacker to steal session cookies, hijack administrative accounts, or modify website content.

Technologies: OpenSolution Quick.CMS. Vendors: OpenSolution.

Quick answers

Is CVE-2021-47981 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47981 being exploited in the wild.
How severe is CVE-2021-47981?: Medium severity, with a CVSS score of 5.4, published 16 May 2026.
Which products and versions are affected?: OpenSolution Quick.CMS 6.7.
Is there a fix for CVE-2021-47981?: A patch was published on 2025-04-24: Vendor released version 6.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-47981 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-47981?: Check whether you run OpenSolution Quick.CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Quick.CMS 6.7 within the 'sliders' administrative form. The root cause is improper neutralization of input in the 'sDescription' parameter at the 'admin.php?p=sliders-form' endpoint. While the vulnerability requires authentication to exploit directly, it can also be triggered via Cross-Site Request Forgery (CSRF) by tricking an authenticated user into submitting a malicious form. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. Version 6.8 has been released by the vendor which may address these issues.

Affected products

OpenSolution Quick.CMS 6.7

Timeline

2021-04-21: disclosed: Initial discovery and exploit development by researcher
2021-11-17: other: Exploit published on Exploit-DB
2025-04-24: patched: Vendor released version 6.8
2026-05-16: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.