CVE-2025-58684

MediumCVSS 6.5

Published: 22/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The WordPress plugin Logo Showcase (logo-showcase) up to version 4.0.1 contains a stored XSS vulnerability due to improper input neutralization during page generation. This allows injection of a malicious script that gets stored and executed in the browser of an administrator or other user.

Risk Assessment

Stored XSS can allow an attacker to hijack admin sessions, steal data, or modify page content, potentially leading to serious security breaches.

Recommendation

Update the Logo Showcase plugin to a version that includes the fix. Also consider regular security audits and restricting content input permissions.

Other vulnerabilities in Logo Showcase

CVE-2026-105060Medium
Stored XSS vulnerability in Logo Showcase plugin up to version 4.0.4. An attacker can inject a malicious script that executes in the administrator's browser.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through <= 4.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS