The Logo Manager For Enamad plugin for WordPress contains a stored cross-site scripting flaw that occurs when the 'title' attribute of the vc_enamad_namad, vc_enamad_shamed, or vc_enamad_custom shortcodes is not properly sanitized. Authenticated users with contributor or higher privileges can insert arbitrary JavaScript into the attribute, causing the script to execute in the browsers of any visitor who loads the affected page. This could allow theft of session cookies, defacement of content, or execution of additional malicious payloads.

All releases of the Logo Manager For Enamad plugin up to and including version 0.7.4 are affected. The plugin is distributed by the vendor goback2 under the product name 'Logo Manager For Enamad'. Any WordPress site that has installed this plugin and has contributors or higher roles that can edit content containing these shortcodes is at risk.

The CVSS base score of 6.4 classifies the vulnerability as moderately severe. Because the exploit requires a legitimate contributor account, the attack surface may be limited to sites with many contributors, but the impact to end users can be significant if scripts are injected. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely abused. Nonetheless, organizations should treat it as a priority risk and apply remediation promptly.