CVE-2026-5694
Published: 15 April 2026
Summary
CVE-2026-5694 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-5694 is a stored cross-site scripting (XSS) vulnerability in the Quick Interest Slider plugin for WordPress, affecting all versions up to and including 3.1.5. The flaw stems from insufficient input sanitization and output escaping of the 'loan-amount' and 'loan-period' parameters, allowing arbitrary web scripts to be injected into pages. It has been assigned a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-79 (Cross-Site Scripting).
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By submitting malicious payloads via the affected parameters, attackers can store scripts on WordPress pages, which then execute in the context of any user's browser that accesses those pages, potentially leading to session hijacking, data theft, or further site compromise due to the changed scope (S:C).
Advisories from sources like Wordfence detail the vulnerability in their threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ce37e7-1dca-4f74-86ce-65bf29ef091e?source=cve), while source code references highlight the unsanitized echoes at lines 1335 and 1338 in quick-interest-slider.php (http://plugins.trac.wordpress.org/browser/quick-interest-slider/tags/3.1.5/quick-interest-slider.php#L1335 and http://plugins.trac.wordpress.org/browser/quick-interest-slider/tags/3.1.5/quick-interest-slider.php#L1338). Mitigation involves updating to a patched version of the plugin if available or removing it entirely, alongside standard WordPress security practices like input validation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22845
Vulnerability details
The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping. This makes it possible for…
more
unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of web application (T1190) and injection/execution of arbitrary JavaScript in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs like 'loan-amount' and 'loan-period' parameters, directly addressing the insufficient input sanitization that enables stored XSS injection.
SI-15 mandates filtering of information outputs, directly mitigating the lack of output escaping in the plugin that allows injected scripts to execute on page access.
SI-2 ensures timely identification, reporting, and remediation of flaws like this stored XSS vulnerability in the Quick Interest Slider plugin via patching or removal.