Executive brief
The Logo Slider plugin for WordPress, used to display brand carousels and client logos, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. When other users or visitors view the affected pages, these scripts can execute in their browsers, potentially leading to unauthorized actions or data theft. This risk is particularly relevant for sites that allow multiple users to manage content.
Technical details
The Logo Slider WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'lgx_tooltip_position' parameter. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts into the database. These scripts will execute in the context of any user's browser who visits the page where the malicious payload is rendered. The vulnerability is present in all versions up to and including 5.5. A patch has been released in subsequent versions to address the improper neutralization of input.
Affected products
- logichunt Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase up to, and including, 5.5
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
References
- https://plugins.trac.wordpress.org/browser/logo-slider-wp/trunk/admin/class-logo-slider-wp-admin.php
- https://plugins.trac.wordpress.org/browser/logo-slider-wp/trunk/public/partials/template/view-default.php
- https://plugins.trac.wordpress.org/browser/logo-slider-wp/trunk/public/partials/view-controller.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3601263%40logo-slider-wp&new=3601263%40logo-slider-wp
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dd321fd7-1f3a-4d1c-b832-69423a35fad5?source=cve