CVE-2026-13247: Logo Slider WordPress Plugin XSS Flaw

CVE-2026-13247 Overview

CVE-2026-13247 is a Stored Cross-Site Scripting (XSS) vulnerability in the Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin. The flaw affects all versions up to and including 5.5. The vulnerability resides in the lgx_tooltip_position parameter, which lacks sufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes when users view an affected page. The issue is categorized under [CWE-79], improper neutralization of input during web page generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browsers of visitors and administrators, enabling session theft, account takeover, and further compromise of the WordPress site.

Affected Products

Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin
All versions up to and including 5.5
WordPress sites permitting contributor-level user registration or access

Discovery Timeline

2026-07-10 - CVE-2026-13247 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-13247

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the Logo Slider WordPress plugin. The plugin accepts the lgx_tooltip_position parameter from authenticated users when configuring logo slider entries. The submitted value is persisted to the database and later rendered into page HTML without proper sanitization or output escaping.

Because the payload is stored, any subsequent visitor loading the affected page triggers execution of the injected script in their browser session. This includes administrators, who may then have their session cookies exfiltrated or actions performed on their behalf via forged requests.

The attack requires contributor-level access or above, lowering the barrier on multi-author WordPress sites where contributor accounts are commonly issued. Successful exploitation grants the attacker the ability to escalate privileges by hijacking administrator sessions.

Root Cause

The plugin fails to apply WordPress sanitization functions such as sanitize_text_field() on the lgx_tooltip_position input at save time. Output rendering in the view templates does not apply escaping functions such as esc_attr() or esc_html(). Relevant code paths exist in WordPress Plugin Admin Code, WordPress Plugin Default View Code, and WordPress Plugin View Controller Code.

Attack Vector

The attack is executed over the network by an authenticated user with contributor privileges. The attacker submits a crafted lgx_tooltip_position value containing HTML attribute-breaking characters and a JavaScript payload through the plugin's admin interface. The malicious value is stored and reflected into a rendered page attribute context. When a victim visits the page, the injected script executes with the origin of the WordPress site. See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2026-13247

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in Logo Slider plugin metadata within the wp_postmeta or plugin-specific tables.
Anomalous POST requests to WordPress admin endpoints containing the lgx_tooltip_position parameter with HTML control characters.
Outbound requests from visitor browsers to attacker-controlled domains originating from pages rendering Logo Slider content.

Detection Strategies

Audit database rows tied to the Logo Slider plugin for stored values containing <, >, ", or javascript: sequences in the lgx_tooltip_position field.
Review WordPress access logs for contributor-level accounts submitting Logo Slider configuration changes that deviate from expected values (e.g., valid positions such as top, bottom, left, right).
Deploy web application firewall rules that flag XSS-indicative payloads on plugin admin routes.

Monitoring Recommendations

Enable WordPress audit logging to capture user metadata changes and post meta updates from contributor accounts.
Monitor for creation of new contributor accounts followed by rapid configuration of Logo Slider entries.
Alert on Content Security Policy (CSP) violation reports indicating inline script execution on pages rendering slider content.

How to Mitigate CVE-2026-13247

Immediate Actions Required

Update the Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin to a version newer than 5.5 that includes the fix.
Review all contributor and higher-privilege accounts and remove unnecessary or dormant users.
Inspect existing Logo Slider entries and remove any records containing suspicious lgx_tooltip_position values.

Patch Information

The vendor addressed the vulnerability in a subsequent release. Refer to the WordPress Plugin Change Set for the code changes applied to sanitize and escape the affected parameter.

Workarounds

Temporarily deactivate the Logo Slider plugin until the patched version is deployed.
Restrict contributor-level and above accounts to trusted users only, and disable open user registration.
Deploy a web application firewall rule that blocks XSS payloads targeting the lgx_tooltip_position parameter on plugin administration endpoints.
Implement a strict Content Security Policy that disallows inline scripts on pages that render Logo Slider output.

bash

# Configuration example: block requests containing script tags in the vulnerable parameter
# Example ModSecurity rule
SecRule ARGS:lgx_tooltip_position "@rx (?i)(<script|onerror=|javascript:)" \
    "id:1026132470,phase:2,deny,status:403,msg:'Blocked XSS attempt against Logo Slider plugin (CVE-2026-13247)'"