TL;DR
A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-6549) in the WordPress plugin “Logo Manager For Enamad” (versions ≤ 0.7.4) lets an authenticated Contributor inject HTML/JavaScript that can persist and execute when higher-privileged users view the data. CVSS: 6.5. If this plugin is installed, follow the immediate mitigation and remediation steps below. If you cannot update or remove the plugin immediately, consider virtual patching at the perimeter.

Why this matters (short, practical explanation)

Stored XSS is frequently abused on WordPress sites. Practical impact for this issue:

• An authenticated Contributor can inject a malicious script into plugin-managed data (for example, logo meta or description fields).
• The malicious script is stored in the database (stored XSS).
• When an administrator, editor or other privileged user views the infected area, the script executes in their browser.
• Consequences include session theft, forged administrative requests, creation of backdoors, or broader site compromise.

Many sites allow contributor registrations or accept contributor submissions, making this a realistic threat even though the initial attacker must be authenticated.

Datos clave

• Affected plugin: Logo Manager For Enamad
• Vulnerable versions: ≤ 0.7.4
• Tipo de vulnerabilidad: Cross-Site Scripting almacenado (XSS)
• Privilegio requerido: Contribuyente (autenticado)
• CVE: CVE-2026-6549
• Puntuación base CVSS: 6.5 (Media)
• Patch status: No official patch available at time of public disclosure
• Exploitation complexity: Requires user interaction / privileged user view

Escenarios de ataque realistas

1. Fields managed by the plugin accept HTML that is not properly escaped or validated. A malicious contributor uploads a logo or enters a crafted string containing
   Revisa Mi Pedido

   0

   Subtotal

   Impuestos y envío calculados en la caja

   Pagar