CVE-2026-5694

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
aerinQuick Interest Slider<= 3.1.5

References

Timeline

Published
Apr 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-569418.4In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalaCVE-2026-569428.8In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalCVE-2026-569432.3In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bouCVE-2026-569447.8In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use AftCVE-2026-569457.8In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additionaCVE-2026-569466.7In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping dCVE-2026-569474.0In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could leaCVE-2026-569496.4In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race coCVE-2026-56958.4Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to tCVE-2026-569504.4In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local inCVE-2026-569518.4In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak host code pointers to a CVE-2026-569526.7In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could
CVE-2026-5694: High severity, CVSS 7.2 | Vulnix