QuickCMS version 6.8 is vulnerable to multiple stored cross-site scripting (XSS) issues in the slider editor functionality. An attacker with admin privileges can inject arbitrary HTML and JavaScript code that will execute on every page. By default, admin users cannot add JavaScript, but this vulnerability allows bypassing that restriction. The vendor has not provided details on affected versions or patches. Other versions beyond 6.8 may also be vulnerable but have not been tested.