CVE-2021-47922
Stored XSS in Slider by Soliloquy WordPress Plugin
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| soliloquy | slider | 2.6.2 |
| soliloquy | slider | to 2.6.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the stored cross-site scripting vulnerability in Slider by Soliloquy 2.6.2 impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2021-47922 is a stored cross-site scripting (XSS) vulnerability in the Slider by Soliloquy WordPress plugin version 2.6.2 or earlier.
This vulnerability allows authenticated attackers to inject malicious JavaScript code through the title parameter when creating or editing sliders.
The injected script then executes in the browsers of users who view the slider on both administrative and frontend pages.
How can this vulnerability impact me? :
This vulnerability can lead to malicious scripts running in the browsers of users who view the affected sliders.
Such scripts can be used to steal sensitive information, hijack user sessions, deface websites, or perform other malicious actions within the context of the affected site.
Because the vulnerability affects both administrative and frontend pages, it can compromise both site administrators and regular users.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored cross-site scripting (XSS) through the title parameter in the Slider by Soliloquy WordPress plugin version 2.6.2 or earlier. Detection involves checking for malicious JavaScript payloads injected into slider titles.
To detect this on your system, you can review the slider titles in the WordPress admin interface for suspicious JavaScript code or unusual script tags.
Additionally, you can search the WordPress database directly for suspicious content in the slider titles. For example, using a MySQL command to find script tags in the slider titles:
- SELECT * FROM wp_soliloquy_sliders WHERE title LIKE '%<script>%';
You may also monitor HTTP traffic for suspicious script execution or injection attempts when authenticated users create or edit sliders.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Slider by Soliloquy plugin to a version later than 2.6.2 where this stored XSS vulnerability is fixed.
If an update is not immediately possible, restrict slider creation and editing permissions to trusted users only, as the vulnerability requires authenticated access.
Additionally, review and sanitize existing slider titles to remove any injected malicious scripts.
Implement web application firewall (WAF) rules to detect and block suspicious script injection attempts targeting the title parameter.