CVE-2026-13247

Name of the Vulnerable Software and Affected Versions Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress versions prior to 5.6

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the lgx tooltip position parameter. These scripts execute automatically when a user visits the affected page.

Recommendations Update the plugin to a version newer than 5.5. Restrict the use of the lgx tooltip position parameter for users with contributor-level access until the update is applied.