{"id":"CVE-2026-81160","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Slick Carousel allows Stored XSS","summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"slick_carousel_project","product":"slick_carousel","affected":["slick_carousel >= 7.x-3.0, <= 7.x-3.2","slick_carousel >= 8.x-2.0, < 8.x-2.1"],"patched":["slick_carousel 8.x-2.1"],"published":"2026-09-02","updated":"2026-10-01","sourceUpdated":"2026-10-01T13:34:17.667","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81160","references":[{"url":"https://www.drupal.org/sa-contrib-2026-117","label":"mlhess@drupal.org"}],"tags":["nvd"],"epss":0.00253,"epssPercentile":0.15097,"ingestedAt":"2026-10-01T13:44:55.811Z","slug":"CVE-2026-81160","body":"## Overview\n\nImproper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.\n\n## Affected\n\n- `slick_carousel >= 7.x-3.0, <= 7.x-3.2`\n- `slick_carousel >= 8.x-2.0, < 8.x-2.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `slick_carousel 8.x-2.1`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}