CVE-2026-105060

MediumCVSS 6.5

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

Stored XSS vulnerability in Logo Showcase plugin up to version 4.0.4. An attacker can inject a malicious script that executes in the administrator's browser.

Risk Assessment

Risk of admin session hijacking, data theft, or website defacement.

Recommendation

Update the Logo Showcase plugin to the latest patched version.

Other vulnerabilities in Logo Showcase

CVE-2025-58684Medium
The WordPress plugin Logo Showcase (logo-showcase) up to version 4.0.1 contains a stored XSS vulnerability due to improper input neutralization during page generation. This allows injection of a malicious script that gets stored and executed in the browser of an administrator or other user.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS