PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47922 Soliloquywp CVE debrief

CVE-2021-47922 describes a stored cross-site scripting issue in Slider by Soliloquy 2.6.2. According to the supplied record, an authenticated attacker can place malicious JavaScript in the slider title field when creating or editing sliders, and that payload can execute in the browsers of users who view the slider on administrative or frontend pages.

Vendor
Soliloquywp
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-10
Original CVE updated
2026-07-25
Advisory published
2026-05-10
Advisory updated
2026-07-25

Who should care

WordPress site owners and administrators running Slider by Soliloquy / Soliloquy Lite, especially environments where editors or other authenticated users can create or edit sliders. Security teams should also review any site that renders these sliders to multiple user groups.

Technical summary

The supplied NVD record classifies the issue as CWE-79 and describes it as a stored XSS in the title parameter of Slider by Soliloquy 2.6.2. The vulnerable flow allows authenticated input to be stored and later rendered in a way that can execute script in both admin and frontend contexts, creating risk for user session exposure, UI redress, and other browser-side impacts.

Defensive priority

Medium: prioritize remediation on any WordPress deployment that exposes slider creation or editing to authenticated users.

Recommended defensive actions

  • Update Slider by Soliloquy to a fixed version if one is available from the vendor or WordPress plugin distribution.
  • If an update is not immediately available, restrict slider creation and editing to the smallest possible set of trusted administrators.
  • Review existing slider titles and related content for unexpected HTML or script-like input and remove suspicious entries.
  • Check for signs of unauthorized slider edits, especially from accounts with content-management privileges.
  • Apply standard browser-side hardening such as a restrictive Content Security Policy where feasible, alongside output encoding and sanitization controls.
  • Monitor affected WordPress sites for user-account abuse or session anomalies after remediation.

Evidence notes

The supplied source corpus includes the official CVE record and NVD entry for CVE-2021-47922, plus references to the vendor site and the WordPress plugin page. The vulnerability description provided in the corpus states that Slider by Soliloquy 2.6.2 has a stored XSS via the title parameter affecting admin and frontend viewers. The supplied feed timestamps for the CVE and source item are 2026-05-10, which are record dates in the corpus and should not be confused with the original vulnerability date.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-47922 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-47922

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-47922 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-47922

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.