CVE-2026-0609 is a stored cross-site scripting vulnerability (CWE-79) in the Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin for WordPress. The flaw exists due to improper neutralization of input in the image alt text field used by the 'logo-slider' shortcode, allowing authenticated users with author-level access or higher to inject arbitrary web scripts. These scripts execute in the context of any user viewing the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to 4.9.0. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, required privileges at the author level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with author-level or higher privileges can inject malicious scripts via the image alt text that will execute in the browsers of users who visit the affected pages. This can lead to unauthorized actions such as session hijacking or data theft limited to the scope of the affected site. The vulnerability does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or removing the vulnerable plugin. Monitor for updates from the vendor or plugin maintainer regarding patches or official mitigations.