View online: https://www.drupal.org/sa-contrib-2026-117 Project: Slick Carousel [1] Date: 2026-August-26 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <2.1.0 CVE IDs: CVE-2026-81160 Description:  Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability. /Note: This vulnerability was fixed in 8.x-2.1 but that was not marked as a security release at the time./ Solution:  * Only the 3.0.x branch is supported by the maintainers. Upgrade to a release on that branch. Reported By:  * Drew Webber (mcdruid) [3] of the Drupal Security Team Fixed By:  * Gaus Surahman (gausarts) [4] Coordinated By:  * Swan Kalata (akalata) [5] of the Drupal Security Team * cilefen [6] of the Drupal Security Team * Neil Drumm (drumm) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/slick [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/u/mcdruid [4] https://www.drupal.org/u/gausarts [5] https://www.drupal.org/u/akalata [6] https://www.drupal.org/u/cilefen [7] https://www.drupal.org/u/drumm [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mcdruid [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....