TL;DR
A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-6549) in the WordPress plugin “Logo Manager For Enamad” (versions ≤ 0.7.4) lets an authenticated Contributor inject HTML/JavaScript that can persist and execute when higher-privileged users view the data. CVSS: 6.5. If this plugin is installed, follow the immediate mitigation and remediation steps below. If you cannot update or remove the plugin immediately, consider virtual patching at the perimeter.

Why this matters (short, practical explanation)

Stored XSS is frequently abused on WordPress sites. Practical impact for this issue:

• An authenticated Contributor can inject a malicious script into plugin-managed data (for example, logo meta or description fields).
• The malicious script is stored in the database (stored XSS).
• When an administrator, editor or other privileged user views the infected area, the script executes in their browser.
• Consequences include session theft, forged administrative requests, creation of backdoors, or broader site compromise.

Many sites allow contributor registrations or accept contributor submissions, making this a realistic threat even though the initial attacker must be authenticated.

关键事实

• Affected plugin: Logo Manager For Enamad
• Vulnerable versions: ≤ 0.7.4
• 漏洞类型：存储型跨站脚本（XSS）
• 所需权限：贡献者（已认证）
• CVE: CVE-2026-6549
• CVSS 基础分数：6.5（中等）
• Patch status: No official patch available at time of public disclosure
• Exploitation complexity: Requires user interaction / privileged user view

现实攻击场景

1. Fields managed by the plugin accept HTML that is not properly escaped or validated. A malicious contributor uploads a logo or enters a crafted string containing
   查看我的订单

   0

   小计

   税费和运费在结账时计算

   结账