WordPress Plugin Vulnerabilities

Logo Slider , Logo Carousel , Logo showcase , Client Logo <= 1.8.1 - Authenticated (Editor+) Stored Cross-Site Scripting

Description

The Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Affects Plugins

Plugin icon
tc-logo-slider
No known fix

References

CVE
CVE-2025-62121
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0616a69a-20a5-476c-904a-881b31b9da18

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.4 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
4c664dbf-32fa-46f4-bc62-60d2efb2eb0a

Timeline

Publicly Published
2025-12-31 (about 7 months ago)
Added
2026-01-05 (about 7 months ago)
Last Updated
2026-01-05 (about 7 months ago)

Other

Published
Title
Published
2022-12-02
Title
Chained Quiz < 1.3.2.1 - Multiple Reflected Cross-Site Scripting
Published
2014-08-01
Title
Image Resizer - Cross Site Scripting
Published
2023-07-26
Title
Your Journey theme <= 1.9.8 - Reflected Cross-Site Scripting via Prototype Pollution
Published
2026-07-02
Title
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot < 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes
Published
2024-10-15
Title
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting