CVE-2025-13153

The Logo Slider WordPress plugin before version 4.9.0 fails to validate and escape certain slider options before outputting them in the WordPress dashboard. This lack of proper sanitization allows malicious input to be stored and later rendered as HTML or JavaScript.

To exploit this vulnerability, an attacker must have at least the Contributor role within a WordPress site. The attack is performed by injecting a payload into slider options that are not properly escaped. When the plugin retrieves and displays these options in the admin dashboard, the stored script executes in the context of the victim's browser session.

Successful exploitation leads to Stored Cross-Site Scripting (XSS). This could allow an attacker to perform operations such as stealing session cookies, modifying content, or performing actions on behalf of the logged-in administrator, potentially compromising the site's security.

A patched version 4.9.0 has been released to fix the issue. Administrators should upgrade the plugin immediately, as the vulnerability is publicly known and could be targeted [1].