CVE-2026-5694 is a stored cross-site scripting vulnerability in the Quick Interest Slider plugin for WordPress, affecting all versions up to 3.1.5. The vulnerability arises from insufficient input sanitization and output escaping of the 'loan-amount' and 'loan-period' parameters, enabling unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, with impact on confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of sensitive information or session hijacking. The vulnerability impacts confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Quick Interest Slider plugin or applying manual input sanitization and output escaping controls if feasible. Monitor vendor channels for updates and apply patches promptly once available.