CVE-2025-47497

WordPress Logo Showcase plugin <= 3.0.4 - Cross Site Scripting (XSS) Vulnerability

Published May 7, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows DOM-Based XSS.This issue affects Logo Showcase: from n/a through <= 3.0.4.

Analysis

Technical impact

The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject arbitrary JavaScript into web pages served by the WordPress Logo Showcase plugin. This DOM‑based XSS flaw can lead to client‑side code execution, theft of user session data, or defacement of the site. The weakness is classified as CWE‑79.

Affected Systems

The affected product is the WordPress Logo Showcase plugin, also known as Logo Showcase. Versions from the initial release up to and including 3.0.4 are vulnerable. Any installation using these versions is at risk.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate severity. The EPSS score of less than 1 % shows a very low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. The flaw is DOM‑based, meaning the exploitation requires a user to visit a crafted URL or interact with a page element that the plugin processes. The likely attack vector involves a malicious link or form input whose value is reflected into the browser’s DOM without proper escaping.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Themepoints

Logo Showcase

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.0.4

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Logo Showcase plugin to a version newer than 3.0.4 as soon as it is available.
If an upgrade cannot be performed immediately, remove or disable the plugin until a patched version is released.
As a short‑term precaution, block or sanitize any user‑supplied data that the plugin outputs, ensuring that all content rendered by the plugin is properly escaped or encoded to prevent execution of injected scripts.

Generated by OpenCVE AI on April 30, 2026 at 20:30 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4192-1	modsecurity-apache security update
EUVD	EUVD-2025-13826	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepoints Logo Showcase allows DOM-Based XSS. This issue affects Logo Showcase: from n/a through 3.0.4.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.269% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://lists.debian.org/debian-lts-announce/2025/05/msg00044.html
https://patchstack.com/database/Wordpress/Plugin/logo-showcase/vulnerability/wordpress-logo-showcase-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepoints Logo Showcase allows DOM-Based XSS. This issue affects Logo Showcase: from n/a through 3.0.4.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows DOM-Based XSS.This issue affects Logo Showcase: from n/a through <= 3.0.4.
Title	WordPress Logo Showcase <= 3.0.4 - Cross Site Scripting (XSS) Vulnerability	WordPress Logo Showcase plugin <= 3.0.4 - Cross Site Scripting (XSS) Vulnerability
References	https://patchstack.com/database/wordpress/plugin/logo-showcase/vulnerability/wordpress-logo-showcase-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/logo-showcase/vulnerability/wordpress-logo-showcase-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Jul 14, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00048}`	epss `{'score': 0.00056}`

May 29, 2025 11:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/05/msg00044.html

May 7, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 7, 2025 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepoints Logo Showcase allows DOM-Based XSS. This issue affects Logo Showcase: from n/a through 3.0.4.
Title		WordPress Logo Showcase <= 3.0.4 - Cross Site Scripting (XSS) Vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/logo-showcase/vulnerability/wordpress-logo-showcase-3-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`