PatchSiren cyber security CVE debrief

CVE-2026-6549 goback2 CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the Logo Manager For Enamad WordPress plugin, affecting versions up to and including 0.7.4. The flaw resides in the 'title' attribute of three shortcodes: `vc_enamad_namad`, `vc_enamad_shamed`, and `vc_enamad_custom`. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when any user accesses an injected page. The vulnerability was disclosed on 2026-05-20 and carries a CVSS 3.1 score of 6.4 (Medium severity). No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: goback2
Product: Logo Manager For Enamad
CVSS: MEDIUM 6.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-20
Original CVE updated: 2026-05-20
Advisory published: 2026-05-20
Advisory updated: 2026-05-20

Who should care

WordPress site administrators using the Logo Manager For Enamad plugin; security teams managing WordPress content management systems; developers maintaining plugins with shortcode functionality

Technical summary

The Logo Manager For Enamad plugin fails to sanitize and escape the 'title' attribute in its Visual Composer shortcodes (vc_enamad_namad, vc_enamad_shamed, vc_enamad_custom). This allows authenticated users with contributor privileges or higher to supply malicious JavaScript payloads that persist in post content and execute in victims' browsers. The vulnerability is classified as stored XSS (CWE-79) with network attack vector, low attack complexity, low privileges required, no user interaction needed, and changed scope impact.

Defensive priority

medium

Recommended defensive actions

Update the Logo Manager For Enamad plugin to a version newer than 0.7.4 if available, or remove the plugin if updates are not forthcoming
Review existing posts and pages for suspicious shortcode usage, particularly examining the 'title' attribute in vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom shortcodes
Implement Content Security Policy headers to mitigate impact of any unpatched XSS vectors
Restrict contributor and author role assignments to trusted users only, as these roles can exploit this vulnerability
Consider using a Web Application Firewall with XSS filtering rules as a compensating control until patching is complete

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code references. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as the underlying weakness. Affected code locations identified in widgets.php at line 295 in both tagged version 0.7.4 and trunk.

Official resources

2026-05-20