Logo Showcase
Monthly
Stored cross-site scripting (CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, affecting all versions through 4.0.4, allows an authenticated low-privileged user to persist malicious script into a logo showcase entry that executes in the browser of any user who later views the rendered page. Because the input is stored rather than reflected, a single submission can fire against administrators or site visitors repeatedly, and the CVSS:3.1 vector (PR:L, UI:R, S:C) confirms that exploitation requires at least a contributor/author-level account on the WordPress site plus victim interaction with the poisoned page. Per Patchstack's report, no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); the plugin's limited install base and the need for a content-submission account keep practical risk moderate rather than critical.
Stored cross-site scripting (CWE-79) in the Themepoints 'Logo Showcase' WordPress plugin, affecting all versions through 4.0.4, allows an authenticated low-privileged user to persist malicious script into a logo showcase entry that executes in the browser of any user who later views the rendered page. Because the input is stored rather than reflected, a single submission can fire against administrators or site visitors repeatedly, and the CVSS:3.1 vector (PR:L, UI:R, S:C) confirms that exploitation requires at least a contributor/author-level account on the WordPress site plus victim interaction with the poisoned page. Per Patchstack's report, no public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); the plugin's limited install base and the need for a content-submission account keep practical risk moderate rather than critical.