CVE-2026-56039
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The vulnerability allows an unauthenticated attacker to perform XSS attacks in Quick Interest Slider versions up to and including 3.1.6.
Risk Assessment
An attacker can inject malicious JavaScript code, leading to session theft, redirects, or website defacement.
Recommendation
Immediately update the Quick Interest Slider plugin to a version newer than 3.1.6.
Other vulnerabilities in Quick Interest Slider <= 3.1.6
See all- CVE-2025-64237Medium
The Quick Interest Slider plugin (versions up to and including 3.1.5) contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this to perform unauthorized operations in the context of a logged-in user.
- CVE-2025-62153Medium
Quick Interest Slider plugin (versions up to 3.1.7) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform actions reserved for privileged roles.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS