Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget… (CVE-2026-42700)

CVE-2026-42700 is a stored cross-site scripting (XSS) vulnerability in the GhozyLab Image Slider Widget (up to version 1.1.130). The issue arises from improper neutralization of input during web page generation, which could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to data disclosure, modification, or denial of service within the scope of the vulnerable application. The attacker requires low privileges and user interaction to exploit this vulnerability. The vulnerability affects confidentiality, integrity, and availability at a limited level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider applying input validation and output encoding as temporary mitigations and restrict privileges to reduce risk.