The Logo Slider WordPress plugin versions up to 3.7.3 contain a flaw where an unchecked value is passed to WordPress do_shortcode, permitting any attacker to inject and run arbitrary shortcodes without authentication. Since shortcodes can execute PHP code, this weakness enables remote code execution, data exfiltration, or other malicious actions. The issue stems from a lack of proper authorization checks and is classified as CWE‑862.

WordPress sites that have the Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin version 3.7.3 or earlier installed are affected. The vendor responsible is listed under samdani at the plugin's repository. Installing any release newer than 3.7.3 removes the vulnerability.

The CVSS score of 7.3 places the vulnerability in the high severity category. Its EPSS score is below 1 %, indicating that exploitation is unlikely in the general WordPress ecosystem at present, and it is not listed in the CISA KEV catalog. However, because the flaw does not require authentication, an attacker can exploit the vulnerability by injecting malicious shortcodes into public-facing content such as posts or comments, making the attack path straightforward once the exploit is discovered.