| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/slick | < 2.1.0 | 2.1.0 |
| slick carousel | ≥ 7.x-3.0, ≤ 7.x-3.2≥ 8.x-2.0, < 8.x-2.1 | 8.x-2.1 |
Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons.
Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability.
Note: This vulnerability was fixed in 8.x-2.1 but that was not marked as a security release at the time.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free