Medium severity · published May 16, 2026
CVE-2021-47981
Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute arbitrary JavaScript in victim browsers when the form is submitted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quick.CMS · Opensolution
6.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47981
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47981
opensolution.org
https://opensolution.org/
opensolution.org
https://opensolution.org/download/home.html?sFile=Quick.Cms_v6.7-en.zip
www.exploit-db.com
https://www.exploit-db.com/exploits/50530
www.vulncheck.com
https://www.vulncheck.com/advisories/quick-cms-cross-site-scripting-via-csrf-to-sliders-form
More from Quick.CMS
9.8
CVE-2024-58308
Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login
8.6
CVE-2023-43345
Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in…
7.5
CVE-2026-11860
Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
7.5
CVE-2025-9982
Hard-coded admin credentials in Quick.CMS
7.2
CVE-2020-35754
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the…