PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6549 goback2 CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the Logo Manager For Enamad WordPress plugin, affecting versions up to and including 0.7.4. The flaw resides in the 'title' attribute of three shortcodes: `vc_enamad_namad`, `vc_enamad_shamed`, and `vc_enamad_custom`. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when any user accesses an injected page. The vulnerability was disclosed on 2026-05-20 and carries a CVSS 3.1 score of 6.4 (Medium severity). No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
goback2
Product
Logo Manager For Enamad
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-24
Advisory published
2026-05-20
Advisory updated
2026-07-24

Who should care

WordPress site administrators using the Logo Manager For Enamad plugin; security teams managing WordPress content management systems; developers maintaining plugins with shortcode functionality

Technical summary

The Logo Manager For Enamad plugin fails to sanitize and escape the 'title' attribute in its Visual Composer shortcodes (vc_enamad_namad, vc_enamad_shamed, vc_enamad_custom). This allows authenticated users with contributor privileges or higher to supply malicious JavaScript payloads that persist in post content and execute in victims' browsers. The vulnerability is classified as stored XSS (CWE-79) with network attack vector, low attack complexity, low privileges required, no user interaction needed, and changed scope impact.

Defensive priority

medium

Recommended defensive actions

  • Update the Logo Manager For Enamad plugin to a version newer than 0.7.4 if available, or remove the plugin if updates are not forthcoming
  • Review existing posts and pages for suspicious shortcode usage, particularly examining the 'title' attribute in vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom shortcodes
  • Implement Content Security Policy headers to mitigate impact of any unpatched XSS vectors
  • Restrict contributor and author role assignments to trusted users only, as these roles can exploit this vulnerability
  • Consider using a Web Application Firewall with XSS filtering rules as a compensating control until patching is complete

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code references. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as the underlying weakness. Affected code locations identified in widgets.php at line 295 in both tagged version 0.7.4 and trunk.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6549 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6549

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6549 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6549

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.