CVE-2021-47922

Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://soliloquywp.com/
https://wordpress.org/plugins/soliloquy-lite/
https://www.exploit-db.com/exploits/50563
https://www.vulncheck.com/advisories/wordpress-plugin-slider-by-soliloquy-stored-xss

Configurations

No configuration.

History

25 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Slider de Soliloquy 2.6.2 contiene una vulnerabilidad de cross-site scripting almacenado que permite a atacantes autenticados inyectar scripts maliciosos a través del parámetro de título. Los atacantes pueden añadir cargas útiles de JavaScript en el campo de título al crear o editar sliders, que se ejecuta en los navegadores de los usuarios que ven el slider tanto en páginas administrativas como en páginas de frontend.

10 May 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-10 13:16

Updated : 2026-07-25 11:10

NVD link : CVE-2021-47922

Mitre link : CVE-2021-47922

CVE.ORG link : CVE-2021-47922

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-47922", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47922", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T14:46:56.546666Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Soliloquywp", "product": "Slider by Soliloquy", "versions": [{"status": "affected", "version": "2.6.2"}]}]}], "published": "2026-05-10T13:16:28.033", "references": [{"url": "https://soliloquywp.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://wordpress.org/plugins/soliloquy-lite/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/50563", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/wordpress-plugin-slider-by-soliloquy-stored-xss", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages."}, {"lang": "es", "value": "Slider de Soliloquy 2.6.2 contiene una vulnerabilidad de cross-site scripting almacenado que permite a atacantes autenticados inyectar scripts maliciosos a trav\u00e9s del par\u00e1metro de t\u00edtulo. Los atacantes pueden a\u00f1adir cargas \u00fatiles de JavaScript en el campo de t\u00edtulo al crear o editar sliders, que se ejecuta en los navegadores de los usuarios que ven el slider tanto en p\u00e1ginas administrativas como en p\u00e1ginas de frontend."}], "lastModified": "2026-07-25T11:10:00.100", "sourceIdentifier": "disclosure@vulncheck.com"}