CVE-2026-13247 logichunt CVE debrief

Who should care

Authenticated attackers with contributor-level access and above should be considered a concern for this vulnerability, as they can inject arbitrary web scripts. Additionally, administrators and security teams responsible for WordPress installations using the affected plugin should prioritize patching or mitigating this vulnerability. Users who manage or interact with the affected plugin, especially in environments with high contributor access, should be aware of the potential risks and take appropriate measures.

Technical summary

The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lgx_tooltip_position' parameter in all versions up to, and including, 5.5. This vulnerability is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts can be executed on pages that users access, potentially leading to malicious activities. The vulnerability has a CVSS score of 6.4, indicating a medium severity level. Technically, the vulnerability can be mitigated by applying patches or updates to the plugin, restricting access to trusted users, and implementing additional security measures.

Defensive priority

Medium priority given the CVSS score of 6.4 and the potential for authenticated attackers to inject arbitrary web scripts.

Recommended defensive actions

• Apply the latest patch or upgrade to a version beyond 5.5
• Restrict contributor-level access and above to trusted users
• Monitor for suspicious activity and injected scripts
• Consider implementing additional security measures such as Web Application Firewall (WAF) rules
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is based on the CVE record and NVD detail. The CVE record was published on 2026-07-10T10:16:23.137Z and has not been modified since then. The NVD entry is currently 6.4 (Medium). The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lgx_tooltip_position' parameter in all versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Evidence limits suggest verifying the CVE record, NVD entry, and potentially other sources for additional information.

Official resources