CVE-2026-42700: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GhozyLab Image Slider Widget

The GhozyLab Image Slider Widget contains a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. This flaw allows an attacker with limited privileges and user interaction to inject malicious scripts that can lead to partial confidentiality, integrity, and availability impacts. The vulnerability affects all versions from 0 up to and including 1.1.130.

Successful exploitation of this vulnerability can result in the execution of arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting privileges and limiting user input to mitigate exploitation risk.