Slick Carousel
Monthly
Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis.