[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXzyYJWQpZMqlh2fbwvY-wfzgreMaE8wOMQKpCZFpGLQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13247","logo-slider-authenticated-contributor-stored-cross-site-scripting-via-lgxtooltipposition-parameter","Logo Slider \u003C= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter","The Logo Slider – Logo Carousel, Client Logo Slider & Brand Showcase for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lgx_tooltip_position' parameter in all versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","logo-slider-wp",null,"\u003C=5.5","5.5.4","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 20:55:09","2026-07-10 09:32:45",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fdd321fd7-1f3a-4d1c-b832-69423a35fad5?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fclass-logo-slider-wp-admin.php","logo-slider-wp.php","public\u002Fassets\u002Fcss\u002Flogosliderwppublic-dep.min.css","public\u002Fpartials\u002Fdynamic-style\u002Fflexbox-style.php","public\u002Fpartials\u002Fdynamic-style\u002Fgeneral-style.php","public\u002Fpartials\u002Fdynamic-style\u002Fgrid-style.php","public\u002Fpartials\u002Fview-controller.php","readme.txt","researched",false,3,"I cannot provide actionable exploit payloads or finalized HTTP request scripts, as my purpose is to promote secure development and responsible research. However, I can provide a detailed technical analysis of the vulnerability mechanics and the code paths involved to assist in your research and remediation efforts.\n\n### 1. Vulnerability Summary\nThe **Logo Slider WP** plugin (versions \u003C= 5.5) is vulnerable to **Stored Cross-Site Scripting (XSS)** due to improper neutralization of the `lgx_tooltip_position` parameter. The vulnerability occurs because the plugin stores this configuration value without sufficient sanitization and subsequently renders it within an HTML attribute in the public-facing view without context-appropriate escaping. An attacker with **Contributor-level** permissions or higher can inject malicious scripts into the slider configuration, which will execute in the browser of any user viewing a page where the affected slider is displayed.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint**: The WordPress post editor for the `logosliderwp` custom post type (`wp-admin\u002Fpost.php`).\n*   **Vulnerable Parameter**: `metaboxlogosliderwp[lgx_tooltip_position]` (part of the slider settings metabox).\n*   **Required Authentication**: Contributor-level access or higher.\n*   **Preconditions**: The \"Tooltip\" feature must be enabled (`lgx_tooltip_en` set to `yes`) for the vulnerable code path in the view controller to be triggered.\n*   **Post Type**: `logosliderwp` (registered in `admin\u002Fclass-logo-slider-wp-admin.php`).\n\n### 3. Code Flow\n1.  **Entry (Admin Side)**: In `admin\u002Fclass-logo-slider-wp-admin.php`, the method `save_post_metadata_of_logosliderwp` is hooked to `save_post`. It captures data from `$_POST['metaboxlogosliderwp']`.\n2.  **Storage**: The plugin retrieves the array and updates the post metadata using `update_post_meta($post_id, 'metaboxlogosliderwp', $postData)`. No validation is performed on the keys or values within the `metaboxlogosliderwp` array, allowing arbitrary strings to be stored in the `lgx_tooltip_position` key.\n3.  **Retrieval (Public Side)**: When a shortcode like `[lgxlogoslider id=\"123\"]` is rendered, the plugin retrieves the stored metadata into the `$lgx_shortcodes_meta` variable.\n4.  **Processing**: In `public\u002Fpartials\u002Fview-controller.php`, if `$lgx_tooltip_en` is `yes`, the plugin populates the `$tooltipDataAttr_Arr` array:\n    ```php\n    $tooltipDataAttr_Arr['tt_position'] = $lgx_shortcodes_meta['lgx_tooltip_position'];\n    ```\n5.  **Sink**: The plugin iterates through this array to build a string of data attributes:\n    ```php\n    foreach ($tooltipDataAttr_Arr as $key => $value) {\n        $tooltipDataAttr_str .= ' data-' . $key . '=\"' . $value . '\" ';\n    }\n    ```\n    The `$value` (containing the injected script) is concatenated directly into the HTML attribute string without using `esc_attr()`. This string is later echoed into the slider'","The Logo Slider WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lgx_tooltip_position' parameter in versions up to 5.5. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into slider configurations which execute in the browser of any user viewing the page where the affected slider is displayed.","\u002F\u002F admin\u002Fclass-logo-slider-wp-admin.php\n$savable_Data['lgx_tooltip_position']            = (( isset($postData['lgx_tooltip_position'])) ? sanitize_text_field( $postData['lgx_tooltip_position'] ) : 'top');\n\n---\n\n\u002F\u002F public\u002Fpartials\u002Fview-controller.php (around line 57)\n$tooltipDataAttr_Arr['tt_position']     = $lgx_shortcodes_meta['lgx_tooltip_position'];\n\n\u002F\u002F ... lines 67-70\n\u002F\u002F Apply Data Attribute\nforeach ($tooltipDataAttr_Arr as $key => $value) {\n    $tooltipDataAttr_str .= ' data-' . $key . '=\"' . $value . '\" ';\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flogo-slider-wp\u002F5.5.0\u002Fadmin\u002Fclass-logo-slider-wp-admin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flogo-slider-wp\u002F5.5.4\u002Fadmin\u002Fclass-logo-slider-wp-admin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flogo-slider-wp\u002F5.5.0\u002Fadmin\u002Fclass-logo-slider-wp-admin.php\t2026-06-05 22:22:44.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flogo-slider-wp\u002F5.5.4\u002Fadmin\u002Fclass-logo-slider-wp-admin.php\t2026-07-09 09:48:04.000000000 +0000\n@@ -991,23 +991,34 @@\n \n \n                 \u002F\u002F Tooltip Settings : Ok\n+                \u002F\u002F Update date : 08.07.2026, By : @VibeLogic\n                 $savable_Data['lgx_tooltip_en']                  = ((isset($postData['lgx_tooltip_en'])) ? 'yes' : 'no');\n-                $savable_Data['lgx_tooltip_content_type']        = (( isset($postData['lgx_tooltip_content_type'])) ? sanitize_text_field( $postData['lgx_tooltip_content_type'] ) : 'brand_name');\n-                $savable_Data['lgx_tooltip_position']            = (( isset($postData['lgx_tooltip_position'])) ? sanitize_text_field( $postData['lgx_tooltip_position'] ) : 'top');\n-                $savable_Data['lgx_tooltip_anim']                = (( isset($postData['lgx_tooltip_anim'])) ? sanitize_text_field( $postData['lgx_tooltip_anim'] ) : 'fade');\n+                \n+                $tooltip_content_type = (( isset($postData['lgx_tooltip_content_type'])) ? sanitize_text_field( $postData['lgx_tooltip_content_type'] ) : 'brand_name');\n+                $savable_Data['lgx_tooltip_content_type']        = in_array($tooltip_content_type, array('brand_name', 'tooltip_text'), true) ? $tooltip_content_type : 'brand_name';\n+                \n+                $tooltip_position = (( isset($postData['lgx_tooltip_position'])) ? sanitize_text_field( $postData['lgx_tooltip_position'] ) : 'top');\n+                $savable_Data['lgx_tooltip_position']            = in_array($tooltip_position, array('top', 'bottom', 'right', 'left'), true) ? $tooltip_position : 'top';\n+                \n+                $tooltip_anim = (( isset($postData['lgx_tooltip_anim'])) ? sanitize_text_field( $postData['lgx_tooltip_anim'] ) : 'fade');\n+                $savable_Data['lgx_tooltip_anim']                = in_array($tooltip_anim, array('fade', 'grow', 'swing', 'slide', 'fall'), true) ? $tooltip_anim : 'fade';\n+                \n                 $savable_Data['lgx_tooltip_arrow_en']            = ((isset($postData['lgx_tooltip_arrow_en'])) ? 'yes' : 'no');\n-                $savable_Data['lgx_tooltip_anim_duration']       = (( isset($postData['lgx_tooltip_anim_duration'])) ? sanitize_text_field( $postData['lgx_tooltip_anim_duration'] ) : 350);\n-                $savable_Data['lgx_tooltip_anim_delay']          = (( isset($postData['lgx_tooltip_anim_delay'])) ? sanitize_text_field( $postData['lgx_tooltip_anim_delay'] ) : 300);\n-                $savable_Data['lgx_tooltip_trigger_type']        = (( isset($postData['lgx_tooltip_trigger_type'])) ? sanitize_text_field( $postData['lgx_tooltip_trigger_type'] ) : 'hover');\n-                $savable_Data['lgx_tooltip_distance']            =(( isset($postData['lgx_tooltip_distance'])) ? sanitize_text_field( $postData['lgx_tooltip_distance'] ) : 6);;\n-                $savable_Data['lgx_tooltip_min_intersection']    = (( isset($postData['lgx_tooltip_min_intersection'])) ? sanitize_text_field( $postData['lgx_tooltip_min_intersection'] ) : 16);\n-                $savable_Data['lgx_tooltip_timer']               = (( isset($postData['lgx_tooltip_timer'])) ? sanitize_text_field( $postData['lgx_tooltip_timer'] ) : 0);\n-                $savable_Data['lgx_tooltip_padding']              = (( isset($postData['lgx_tooltip_padding'])) ? sanitize_text_field( $postData['lgx_tooltip_padding'] ) : '8px');\n+                $savable_Data['lgx_tooltip_anim_duration']       = (( isset($postData['lgx_tooltip_anim_duration'])) ? intval( $postData['lgx_tooltip_anim_duration'] ) : 350);\n+                $savable_Data['lgx_tooltip_anim_delay']          = (( isset($postData['lgx_tooltip_anim_delay'])) ? intval( $postData['lgx_tooltip_anim_delay'] ) : 300);\n+                \n+                $tooltip_trigger = (( isset($postData['lgx_tooltip_trigger_type'])) ? sanitize_text_field( $postData['lgx_tooltip_trigger_type'] ) : 'hover');\n+                $savable_Data['lgx_tooltip_trigger_type']        = in_array($tooltip_trigger, array('hover', 'click'), true) ? $tooltip_trigger : 'hover';\n+                \n+                $savable_Data['lgx_tooltip_distance']            = (( isset($postData['lgx_tooltip_distance'])) ? sanitize_text_field( $postData['lgx_tooltip_distance'] ) : 6);\n+                $savable_Data['lgx_tooltip_min_intersection']    = (( isset($postData['lgx_tooltip_min_intersection'])) ? intval( $postData['lgx_tooltip_min_intersection'] ) : 16);\n+                $savable_Data['lgx_tooltip_timer']               = (( isset($postData['lgx_tooltip_timer'])) ? intval( $postData['lgx_tooltip_timer'] ) : 0);\n+                $savable_Data['lgx_tooltip_padding']             = (( isset($postData['lgx_tooltip_padding'])) ? sanitize_text_field( $postData['lgx_tooltip_padding'] ) : '8px');\n                 $savable_Data['lgx_tooltip_text_color']          = (( isset($postData['lgx_tooltip_text_color'])) ? sanitize_text_field( $postData['lgx_tooltip_text_color'] ) : '#ffffff');\n                 $savable_Data['lgx_tooltip_bg_color']            = (( isset($postData['lgx_tooltip_bg_color'])) ? sanitize_text_field( $postData['lgx_tooltip_bg_color'] ) : '#d3d3d3');\n                 $savable_Data['lgx_tooltip_border_color']        = (( isset($postData['lgx_tooltip_border_color'])) ? sanitize_text_field( $postData['lgx_tooltip_border_color'] ) : '#333333');\n                 $savable_Data['lgx_tooltip_border_radius']       = (( isset($postData['lgx_tooltip_border_radius'])) ? sanitize_text_field( $postData['lgx_tooltip_border_radius'] ) : '4px');\n-                $savable_Data['lgx_tooltip_border_width']       = (( isset($postData['lgx_tooltip_border_width'])) ? sanitize_text_field( $postData['lgx_tooltip_border_width'] ) : '2px');\n+                $savable_Data['lgx_tooltip_border_width']        = (( isset($postData['lgx_tooltip_border_width'])) ? sanitize_text_field( $postData['lgx_tooltip_border_width'] ) : '2px');\n                 $savable_Data['lgx_tooltip_arrow_bg_color']      = (( isset($postData['lgx_tooltip_arrow_bg_color'])) ? sanitize_text_field( $postData['lgx_tooltip_arrow_bg_color'] ) : '#555555');\n                 $savable_Data['lgx_tooltip_arrow_border_color']  = (( isset($postData['lgx_tooltip_arrow_border_color'])) ? sanitize_text_field( $postData['lgx_tooltip_arrow_border_color'] ) : '#333333');","1. Authenticate to the WordPress dashboard with at least Contributor-level privileges.\n2. Navigate to the 'Logo Slider' custom post type and create or edit a slider.\n3. In the slider settings (specifically the Tooltip section), enable tooltips (set 'lgx_tooltip_en' to 'yes').\n4. Inject a malicious XSS payload into the 'lgx_tooltip_position' parameter, for example: `top\" onmouseover=\"alert(document.cookie)`. \n5. Save the post. The plugin stores this value in the `metaboxlogosliderwp` post meta array.\n6. Visit the public page where this slider is embedded (via shortcode). \n7. The plugin will render the slider and include the malicious payload within the HTML `data-tt_position` attribute. Because the value is not escaped with `esc_attr()`, the double quote in the payload breaks out of the attribute, and the `onmouseover` event handler is added to the HTML element, executing the script when a user interacts with the slider.","gemini-3-flash-preview","2026-07-15 10:17:34","2026-07-15 10:19:12",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.5.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flogo-slider-wp\u002Ftags\u002F5.5.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flogo-slider-wp.5.5.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flogo-slider-wp\u002Ftags\u002F5.5.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flogo-slider-wp.5.5.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flogo-slider-wp\u002Ftags"]