TL;DR
A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-6549) in the WordPress plugin “Logo Manager For Enamad” (versions ≤ 0.7.4) lets an authenticated Contributor inject HTML/JavaScript that can persist and execute when higher-privileged users view the data. CVSS: 6.5. If this plugin is installed, follow the immediate mitigation and remediation steps below. If you cannot update or remove the plugin immediately, consider virtual patching at the perimeter.

Why this matters (short, practical explanation)

Stored XSS is frequently abused on WordPress sites. Practical impact for this issue:

• An authenticated Contributor can inject a malicious script into plugin-managed data (for example, logo meta or description fields).
• The malicious script is stored in the database (stored XSS).
• When an administrator, editor or other privileged user views the infected area, the script executes in their browser.
• Consequences include session theft, forged administrative requests, creation of backdoors, or broader site compromise.

Many sites allow contributor registrations or accept contributor submissions, making this a realistic threat even though the initial attacker must be authenticated.

主要事實

• Affected plugin: Logo Manager For Enamad
• Vulnerable versions: ≤ 0.7.4
• 漏洞類型：儲存型跨站腳本 (XSS)
• 所需權限：貢獻者（已驗證）
• CVE: CVE-2026-6549
• CVSS 基本分數：6.5（中等）
• Patch status: No official patch available at time of public disclosure
• Exploitation complexity: Requires user interaction / privileged user view

現實攻擊場景

1. Fields managed by the plugin accept HTML that is not properly escaped or validated. A malicious contributor uploads a logo or enters a crafted string containing
   查看我的訂單

   0

   小計

   稅金和運費在結帳時計算

   結帳