WEN Logo Slider < 3.5 – Authenticated (Author+) Stored Cross-Site Scripting | CVE 2025-62127 | Plugin Vulnerabilities

Description

The WEN Logo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

wen-logo-slider

Fixed in 3.5

References

CVE

URL

https://www.wordfence.com/threat-intel/vulnerabilities/id/d11295b5-0847-4c71-92fa-c35ba7fe7078

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Nabil Irawan

Verified

No

WPVDB ID

dccd0ffd-ca72-4c72-89d2-1e15fb00a0cb

Timeline

Publicly Published

2026-05-07 (about 3 months ago)

Added

2026-05-11 (about 3 months ago)

Last Updated

2026-05-11 (about 3 months ago)

Other

Published

Title

Published

2025-08-15

Title

Uji Countdown <= 2.3.3 - Reflected Cross-Site Scripting

Published

2025-09-26

Title

bbp topic count <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-24

Title

Xpert Tab <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-03-17

Title

Elementor < 3.1.4 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget

Published

2025-03-28

Title

TGG WP Optimizer <= 1.25 - Admin+ Stored XSS