The tgrk Custom Logo WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated attackers with administrator privileges can inject arbitrary scripts via the plugin's admin settings. This vulnerability affects multi-site installations or sites where unfiltered_html is disabled, impacting all versions up to 2.2. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and no user interaction required. No known exploits are reported in the wild, and no patch or remediation details are provided.

An authenticated attacker with administrator-level permissions can inject malicious scripts into pages via the Custom Logo plugin settings. These scripts execute whenever a user accesses the injected page, potentially leading to data theft, session hijacking, or other script-based attacks. The impact is limited to multi-site WordPress installations or those with unfiltered_html disabled. The vulnerability does not affect availability and requires high privileges and network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Custom Logo plugin in affected environments, especially multi-site installations or those with unfiltered_html disabled.