EUVD-2026-31042
GHSA-jxx5-9gww-wrxc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Logo Manager For Enamad WordPress plugin (versions up to and including 0.7.4) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'title' attribute of three shortcodes - vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom. The injected payload executes in the browser of any user who subsequently visits the compromised page, enabling session hijacking, credential theft, or malicious redirects against site visitors and administrators. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement (contributor) broadens the realistic attacker pool on multi-author WordPress sites.
Technical ContextAI
The affected component is the Logo Manager For Enamad WordPress plugin (vendor: goback2, CPE: cpe:2.3:a:goback2:logo_manager_for_enamad:*:*:*:*:*:*:*:*), which integrates with Visual Composer shortcodes to render Iranian e-trust seal logos (Enamad). The vulnerability resides in widgets.php at line 295, where user-supplied values for the 'title' attribute of the vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom shortcodes are neither sanitized on input nor escaped on output. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes this root cause: attacker-controlled data flows from the database to HTML output without encoding, allowing arbitrary JavaScript to be embedded in rendered pages. The CVSS scope is Changed (S:C), reflecting that the injected script executes in the victim's browser context rather than the WordPress application context, crossing a security boundary.
RemediationAI
No specific patched version has been confirmed from the available input data. Site administrators should immediately check the WordPress.org plugin repository (https://wordpress.org/plugins/logo-manager-for-enamad) for an updated release beyond 0.7.4 and apply it if available. The Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6d1167-c89d-4c97-9446-b968df945e6c?source=cve should be monitored for patch confirmation. As a compensating control pending a patch, administrators should restrict contributor-level account creation and audit existing contributor accounts for legitimacy, since the attack requires that privilege level. Additionally, a Web Application Firewall with WordPress XSS rules (such as Wordfence's own firewall) can block the injection attempt at the request layer, though this does not remediate the underlying flaw. Disabling the affected shortcodes (vc_enamad_namad, vc_enamad_shamed, vc_enamad_custom) in page content if not actively needed eliminates the attack surface without removing the plugin entirely.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today