CVE-2026-13247 is a stored Cross-Site Scripting vulnerability in the Logo Slider WP plugin for WordPress, specifically affecting the 'lgx_tooltip_position' parameter. The flaw exists in all versions up to and including 5.5 due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of other users viewing the injected pages. This can lead to information disclosure or session hijacking but does not impact availability. No official patch or remediation guidance is currently documented.

An attacker with contributor-level or higher access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to limited confidentiality and integrity impacts such as theft of user credentials or unauthorized actions performed on behalf of users. There is no impact on system availability. The vulnerability requires authenticated access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor or security advisories for a patch or official mitigation instructions.