Medium severity · published Jan 2, 2026
CVE-2025-13153
Logo Slider < 4.9.0 - Contributor+ Stored XSS
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Logo Slider ·
before 4.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13153
wpscan.com
https://wpscan.com/vulnerability/0ed67947-228d-420c-8d28-e0d7326eb101/
More from Logo Slider
7.6
CVE-2024-5429
Logo Slider < 4.1.0 - Contributor+ Stored XSS
5.4
CVE-2024-12308
Logo Slider < 4.6.0 - Contributor+ Stored XSS
5.4
CVE-2024-10896
Logo Slider < 4.5.0 - Contributor+ Stored XSS
5.4
CVE-2024-10473
Logo Slider < 4.5.0 - Author+ Stored XSS
5.4
CVE-2024-3288
Logo Slider < 4.0.0 - Contributor+ Stored XSS