A plugin packaged in Logseq can place arbitrary JavaScript in the package.json field named "name", and that field is rendered with innerHTML in the interface without any sanitization. The payload is stored and executed when the interface loads, allowing a malicious plugin to run code with the same privileges as the host application. This stored XSS can lead to the theft of user data, session hijacking, or more severe attacks if the host context is privileged.

The vulnerability was confirmed in Logseq version v0.10.15. No official patch has been released, and the impact on later or earlier releases is not documented. Users running the affected version or a future version that still uses the same unsanitized rendering path are potentially at risk; anyone who installs a malicious plugin could trigger the attacker code.

The score of 4.6 indicates moderate severity, and the EPSS is currently not available. The vulnerability is not recorded in the CISA KEV catalog. Likely the attack vector is installation of a malicious or compromised plugin by a user; once the plugin is loaded the XSS payload executes automatically. There are no known public exploits and mitigation is mainly to avoid installing untrusted plugins or to update Logseq when a fix is released.