Logo Showcase EUVD-2026-92319

Exploitation requires an authenticated WordPress account with at least the privilege level permitted to create or edit Logo Showcase content (PR:L - typically contributor/author or a role the site grants to submit logo entries), and it requires victim user interaction (UI:R): a second user (commonly an administrator or site visitor) must view the page where the stored payload is rendered for the script to fire. Limiting factors: this is not remote-unauthenticated - sites that do not grant untrusted users content-submission accounts are substantially less exposed, and the scope-change impact depends on the victim's browser session rather than directly compromising the server. The specific input field/plugin feature that stores the unsanitized value is not named in the description.

This is a moderate-severity stored XSS (CVSS 6.5, CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in a different security context (the victim's browser/session). Exploitation status: no public exploit identified at time of analysis - the issue is not listed in CISA KEV and no POC is referenced in the provided data, so there is no evidence of active exploitation. No EPSS score or SSVC decision data was provided, so exploitation probability cannot be quantified from the inputs. Realistically this is a typical Patchstack-catalogued plugin XSS: genuine but not an emergency - the PR:L and UI:R requirements plus the niche footprint of this specific plugin make it a patch-in-normal-cycle item rather than a drop-everything priority, unless the affected site grants untrusted users contributor-level access.

An attacker holding a low-privileged authenticated account (e.g., contributor or author) on a WordPress site running Logo Showcase ≤4.0.4 submits a logo entry containing a malicious script payload that is stored by the plugin. When an administrator or other user later views the page or dashboard where that content is rendered, the script executes in their browser, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified, so exploitation would require an attacker to craft the payload independently.