Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo tc-logo-slider allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through <= 1.8.1.
Published: 2025-12-31
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stored XSS flaw exists in the Imran Emu Logo Slider, Logo Carousel, Logo Showcase, Client Logo plugin. Improper input neutralization allows attackers to inject arbitrary JavaScript that is persisted in the database and executed when other users load affected pages. This can lead to session hijacking, defacement, or delivery of malware to site visitors, representing a typical CWE‑79 vulnerability.

Affected Systems

WordPress sites that have installed Imran Emu’s Logo Slider, Logo Carousel, Logo Showcase, Client Logo plugin version 1.8.1 or earlier are affected.

Risk and Exploitability

The CVSS score of 5.9 reflects a medium severity assessment, and the EPSS score of less than 1 % indicates a low probability of exploitation. The plugin is not included in the CISA KEV catalog. Attackers would likely target sites that expose the plugin’s stored content or that have been compromised for administrative access, injecting malicious payloads through the plugin’s input fields.

Generated by OpenCVE AI on April 29, 2026 at 18:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the plugin to a version that removes the stored XSS flaw, such as 1.9 or later.
  • If an immediate upgrade is not feasible, disable the plugin or remove any custom content that may contain unescaped HTML to prevent script execution.
  • Conduct a site‑wide review of all content that is stored via the plugin, sanitizing or escaping any user‑generated input, and verify that all output is properly encoded before rendering.

Generated by OpenCVE AI on April 29, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through 1.8.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo tc-logo-slider allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through <= 1.8.1.
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Mon, 05 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Wed, 31 Dec 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 31 Dec 2025 14:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo showcase , Client Logo: from n/a through 1.8.1.
Title WordPress Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:02.243Z

Reserved: 2025-10-07T15:41:34.897Z

Link: CVE-2025-62121

cve-icon Vulnrichment

Updated: 2025-12-31T17:33:15.291Z

cve-icon NVD

Status : Deferred

Published: 2025-12-31T14:15:52.810

Modified: 2026-04-23T15:34:34.863

Link: CVE-2025-62121

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T18:15:17Z

Weaknesses