EUVD-2026-39701
GHSA-cx36-2wx4-c9rp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS needing a victim click (UI:R, PR:N); injected script escapes the plugin into the site session (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.
AnalysisAI
Reflected cross-site scripting in the Quick Interest Slider WordPress plugin (versions 3.1.6 and earlier) lets an unauthenticated attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious page. The CVSS 3.1 base score is 7.1 with a scope change, reflecting that script execution crosses the plugin's security boundary into the broader WordPress session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Quick Interest Slider plugin (version 3.1.6 or earlier) to be installed and active on the target WordPress site, and requires user interaction (UI:R): a victim must click an attacker-crafted link or load an attacker-controlled page that triggers the reflected request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L yields 7.1 (High): network-reachable, low complexity, no privileges, but requiring user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL pointing at the victim WordPress site with a malicious script payload embedded in a vulnerable Quick Interest Slider parameter, then sends it to a site administrator via email or a forum post. When the logged-in admin clicks the link, the reflected payload executes in their browser under the site's origin, letting the attacker run actions as that admin (e.g., create a rogue user or steal session data). … |
| Remediation | No fixed version was provided in the input data, so no vendor-released patch is independently confirmed at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quick-interest-slider/vulnerability/wordpress-quick-interest-slider-plugin-3-1-6-reflected-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for any release above 3.1.6 and upgrade as soon as one is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress instances running Quick Interest Slider and document current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today