Gs Logo Slider
Monthly
GS Logo Slider, a WordPress plugin from GS Plugins, is affected through version 3.8.9 by PHP object injection: untrusted data reaching a deserialization routine lets an attacker with at least low-privilege access on a WordPress site instantiate arbitrary objects, with a CVSS score of 8.8 reflecting high confidentiality, integrity and availability impact. Because exploitation depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin or theme, real-world risk varies by installation; the specific vulnerable parameter and trigger are not described in the available sources. A public PoC reference exists in the Patchstack advisory, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
GS Logo Slider, a WordPress plugin from GS Plugins, is affected through version 3.8.9 by PHP object injection: untrusted data reaching a deserialization routine lets an attacker with at least low-privilege access on a WordPress site instantiate arbitrary objects, with a CVSS score of 8.8 reflecting high confidentiality, integrity and availability impact. Because exploitation depends on a usable POP gadget chain being present in the plugin, WordPress core, or another installed plugin or theme, real-world risk varies by installation; the specific vulnerable parameter and trigger are not described in the available sources. A public PoC reference exists in the Patchstack advisory, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.