CVE-2026-13247: Stored XSS in Logo Slider WordPress Plugin v5.5 and Earlier

Technical summary

CVE-2026-13247 is a Stored Cross-Site Scripting (XSS) vulnerability in the Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase plugin for WordPress. The flaw stems from insufficient input sanitization and output escaping of the 'lgx_tooltip_position' parameter across all versions up to and including 5.5. An authenticated attacker with contributor-level privileges or above can inject arbitrary JavaScript that persists in the database and executes in the browsers of all users who access the affected page, satisfying the conditions for stored XSS exploitation.

Business impact

Organizations running this plugin face risk of website defacement, session hijacking, credential theft, and malware distribution. Because the XSS payload is stored in the database, the impact persists until remediated—every site visitor becomes a potential victim. For sites handling customer data or e-commerce transactions, this creates compliance and liability concerns. The requirement for authenticated access at contributor level limits the immediate threat surface, but compromised or malicious contributors pose a direct risk.

Affected systems

WordPress installations using the Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase plugin version 5.5 and earlier are affected. The vulnerability requires an authenticated attacker with contributor-level access or higher, meaning sites should assess which users hold these permissions and whether any have been compromised.

Exploitability

This vulnerability has a CVSS score of 6.4 (Medium severity) with a vector reflecting network accessibility, low attack complexity, and requirement for low privileges (authenticated contributor access). Exploitation requires user interaction in the sense that the payload executes when visitors view the injected page, but the attacker does not need to socially engineer targets—the malicious content runs automatically. The attack is not publicly known to be actively exploited based on available intelligence, and it does not appear on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update the Logo Slider plugin to a patched version released after July 10, 2026. Verify the specific patched version against the plugin's official repository or vendor advisory. In the interim, restrict contributor-level access to users who genuinely require it, review recent post and page edits for suspicious modifications, and consider disabling the plugin if it is not essential.

Patch guidance

Check the WordPress plugin repository or the plugin vendor's official advisory for available updates addressing this vulnerability. Apply patches as soon as testing confirms compatibility with your WordPress version and other active plugins. Given the stored XSS nature, prioritize patching over delaying updates—this vulnerability can persist invisibly in your database.

Detection guidance

Search your WordPress database for suspicious content in posts, pages, and plugin settings that contain script tags or JavaScript event handlers, particularly in the 'lgx_tooltip_position' parameter or custom fields associated with the Logo Slider plugin. Review WordPress user activity logs for any edits by contributor-level accounts around the time the vulnerability was disclosed (July 2026 onwards). Monitor website traffic for unusual client-side behavior or unexpected JavaScript execution. Use WordPress security plugins with XSS detection capabilities to scan stored content.

Why prioritize this

Although rated CVSS 6.4 (Medium), prioritize this vulnerability because stored XSS poses persistent and pervasive risk—once injected, the malicious script affects all site visitors until removal. The attack surface is limited by the authentication requirement, but the impact on data confidentiality and integrity is real. Organizations should address this within 30 days, sooner if the plugin is actively used on customer-facing or data-handling pages.

Risk score, explained

The CVSS 6.4 (Medium) score reflects the network-accessible nature of the vulnerability (AV:N), the ease of exploitation once authenticated (AC:L, PR:L), and the cross-site impact (S:C). However, the score does not account for the stored nature of the XSS, which amplifies real-world risk by ensuring every visitor is exposed. The lack of authentication bypass and the requirement for contributor-level access prevent a higher score, but the scope change acknowledges that the vulnerability affects confidentiality and integrity of user sessions beyond the attacker's own.

Frequently asked questions