The WP Logo Changer plugin contains an Improper Neutralization of Input During Web Page Generation vulnerability, which allows attackers to store malicious JavaScript code. When site visitors load a page that includes the stored data, the injected script executes in their browsers, enabling credential theft, defacement, or other malicious actions. The flaw is a classic stored XSS and is classified as CWE‑79.

WordPress sites that have installed the WP Logo Changer plugin version 1.2 or earlier, specifically the am‑login‑logo plugin by Afzal Multani. No later versions are known to be affected.

The CVSS score of 7.1 indicates a high impact potential; however, the EPSS of less than 1% shows that it is currently rarely exploited in the wild, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need to inject malicious content into the plugin's configuration—typically an administrator or user with permission to modify the logo settings. Once stored, any visitor to the affected page would run the script. Given the low exploitation probability but significant potential damage, prompt remediation is advised.