The Logo Showcase plugin contains an improper neutralization of input during web page generation, enabling stored cross‑site scripting. An attacker can save malicious scripts in the plugin’s data fields, which are then rendered unescaped on the site. When a user visits a page displaying that data, the injected script runs in the victim’s browser, potentially allowing session hijacking, credential theft, or malicious redirects. This flaw compromises client‑side integrity and confidentiality but does not grant direct server‑side access.

The vulnerability affects installations of the Themepoints Logo Showcase plugin for WordPress with versions 4.0.1 or earlier. Any WordPress site running the plugin up to and including that version is at risk; the WordPress core version is irrelevant to the flaw.

The CVSS score of 6.5 classifies the vulnerability as moderate. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. The attack vector is client‑side via a user’s web browser; an attacker can exploit the flaw by supplying crafted input that is stored by the plugin and subsequently displayed on the site. No administrative privileges are required beyond the ability to input data into the plugin’s fields.