Logo Showcase with Slick Slider <= 2.0 - Cross-Site Request Forgery

The Logo Showcase with Slick Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the lswss_save_attachment_data AJAX action. This makes it possible for unauthenticated attackers to change the title, description, alt text, and URL of arbitrary uploaded media via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.