CVE-2026-5694
Stored XSS in Quick Interest Slider WordPress Plugin Allows Script Injection
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| quick_interest_slider | plugin | to 3.1.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject arbitrary web scripts via stored cross-site scripting (XSS) in the Quick Interest Slider plugin. This can lead to unauthorized access to user data or session hijacking.
Such security weaknesses can impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure handling of user information to prevent unauthorized access or data breaches.
Failure to address this vulnerability could result in violations of these regulations due to potential data exposure or compromise caused by the XSS attack.
Can you explain this vulnerability to me?
The Quick Interest Slider plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.1.5. This vulnerability arises because the plugin does not properly sanitize or escape input in the 'loan-amount' and 'loan-period' parameters.
As a result, an unauthenticated attacker can inject malicious scripts into pages that use these parameters. When other users access these pages, the injected scripts execute in their browsers.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary scripts in the context of the affected website, potentially leading to theft of user data, session hijacking, or defacement of the website.
Because the vulnerability is exploitable without authentication, any visitor to the affected pages could be impacted.
The CVSS score of 7.2 indicates a high severity, with impacts on confidentiality and integrity, but not availability.