GS Logo Slider CVE-2026-116391

Requires an authenticated attacker with at least low privileges (CVSS PR:L) on a WordPress site running GS Logo Slider up to and including 3.8.9; the attacker must reach a plugin input that is deserialized without validation and supply crafted serialized PHP data. Meaningful impact additionally depends on a usable POP gadget chain being available in the plugin, WordPress core, or another installed plugin/theme - a factor that limits exploitation in hardened or minimal installations. The specific vulnerable parameter/endpoint and the triggering mechanism are not described in the available sources. Limiting factors: valid low-privilege credentials are required (not unauthenticated), and exploitation is bounded by gadget-chain availability in the target environment.

This is a genuine prioritization candidate but short of an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality, integrity and availability impact - consistent with PHP Object Injection that can escalate to code execution or data compromise when a usable gadget chain is present. The vuln.today decision label is 'this_week', which indicates meaningful urgency without being 'act_now' or 'emergency'. Countervailing signals temper the raw score: there is no CISA KEV listing (not confirmed actively exploited), no EPSS score was provided in the input (exploitation probability unknown - do not assume high or low), and no verified public exploit code. The PR:L requirement is also a real gatekeeper - exploitation presupposes an attacker already holding at least a low-privilege authenticated account on the target WordPress site, which lowers real-world risk relative to a fully unauthenticated flaw. Net: credible high-severity issue warranting prompt patching per the 'this_week' label, but not evidenced as under active mass exploitation.

An attacker holding a low-privilege authenticated account (per CVSS PR:L) on a WordPress site running GS Logo Slider ≤ 3.8.9 submits crafted serialized PHP data to an input that the plugin deserializes without validation. If a suitable property-oriented programming (POP) gadget chain exists in the plugin, WordPress core, or another installed component, the resulting object injection can lead to data tampering, information disclosure, or code execution. No public exploit was identified at the time of analysis, and the exact triggering parameter is not described in the available sources.