What is the CVSS score of CVE-2026-0609?

CVE-2026-0609 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-0609?

Organizations using Client Logo Slider Plugin should be aware of moderate risk from CVE-2026-0609, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-0609?

Within 30 days: Identify affected systems running plugin for WordPress is vulnerable to Stored Cross-Site Scri and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-0609

EUVD-2026-14168 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-68cq-6242-rqxv

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14168

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Logo Slider - Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping in the 'logo-slider' shortcode. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Logo Slider WordPress plugin (versions up to 4.9.0) that allows authenticated attackers with author-level privileges to inject malicious scripts through image alt text in the 'logo-slider' shortcode. The vulnerability stems from insufficient input sanitization and output escaping, enabling persistent script execution whenever users access pages containing the injected content. With a CVSS score of 6.4 and moderate real-world exploitability, this represents a credible threat to WordPress sites with multiple trusted authors.

Technical ContextAI

The vulnerability is a classic Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin designed to display client logos. The 'logo-slider' shortcode processes image alt text parameters without properly sanitizing user input or escaping output when rendering HTML. WordPress plugins typically process shortcode attributes via the do_shortcode() function and render them in the frontend via PHP echo statements; this plugin fails at both the sanitization stage (wp_sanitize_post_kses or similar functions were not applied) and the escaping stage (esc_attr() or esc_html() functions are absent). The affected product is identified by CPE cpe:2.3:a:logichunt:logo_slider_–_logo_carousel,_logo_showcase_&_client_logo_slider_plugin:*:*:*:*:*:*:*:*. The vulnerability affects all versions through 4.9.0, as confirmed by Wordfence threat intelligence and the WordPress plugin repository source code inspection at lines 309-314 of the public-facing class file.

RemediationAI

Immediately update the Logo Slider plugin to the latest patched version available from the WordPress plugin repository (https://wordpress.org/plugins/logo-slider-wp/). If an update beyond 4.9.0 has been released, upgrade to that version. Until patching is completed, limit author-level access to trusted users only, regularly audit user roles and capabilities, and consider temporarily disabling the 'logo-slider' shortcode via code removal or a security plugin until the patch is applied. For defense-in-depth, implement a Web Application Firewall (WAF) to detect and block XSS payloads in POST/PUT requests, enable WordPress security hardening plugins that sanitize shortcode output, and educate site administrators about the risks of granting author credentials to untrusted users. Review the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b94f388a-c4af-4d3a-bd41-9b2d5d990672?source=cve for additional context and timeline information.