Slick Slider
Monthly
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.