The Logichunt Logo Slider plugin is vulnerable to stored Cross‑Site Scripting via the image alt text within the 'logo-slider' shortcode. An attacker who can authenticate as an author or a higher level user can enter malicious script into the alt text field. When any user views a page containing the injected content, the script executes in that user’s browser.

WordPress sites running Logichunt Logo Slider version 4.9.0 or earlier are affected. The flaw is present in every release up to and including 4.9.0.

The CVSS score is 6.4, indicating moderate severity. The attacker must have author‑level or higher credentials to inject the payload, making internal attackers or compromised author accounts the primary threat vector. No EPSS data is available and the vulnerability is not listed in the KEV catalog, suggesting no widespread public exploitation yet, but any site that allows author‑level content creation remains at risk.