Skip to content
Laskyr
Free scan
Scan my site free

Read-only. Nothing on your site is changed.

Plugins · gs-logo-slider · data as of 2026-11-04

Is Logo Slider safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (3.9.1)

As of 2026-11-04. 13 issues are on record for older versions; version 3.9.0 or newer fixes all of them that state a fix.

Latest version
3.9.1
Last updated
2026-11-03
Active installs
30,000+
Known issues on record
13
Unpatched in latest
0
Tested up to WP
7.1.4 · PHP 7.4+

Show client, partner and sponsor logos in a responsive logo slider, carousel, ticker or grid. Shortcode builder with live preview, no coding. — by GS Plugins

What to do

  1. Update to the latest version (3.9.1). Anything older than 3.9.0 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
  2. If you cannot update right away, deactivate it until you can.
  3. Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
  4. If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get gs-logo-slider --field=version shows what you run; wp plugin update gs-logo-slider updates it.

Check your version

Known vulnerabilities

13 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. 6 record(s) do not state which versions are affected.

high 8.8 CVE-2026-116391 · published 2026-10-28

PHP object injection in Logo Slider (3.8.9 and older)

Affected
3.8.9 and older
Fixed in
3.9.0
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber)
Range from
CVE record (the advisory publisher) · score by Patchstack
Details from the advisory

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.

NVD CVE-2026-116391Patchstack advisory

medium 6.1 CVE-2025-13153 · published 2026-01-02

Stored cross-site scripting (XSS) in Logo Slider (older than 4.9.0)

Affected
older than 4.9.0
Fixed in
unknown
Access needed (per CVSS)
No login needed; someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest Logo Slider release on wordpress.org (3.9.1), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

NVD CVE-2025-13153WPScan advisory

medium 4.3 CVE-2024-9233 · published 2025-05-15

Cross-site request forgery (CSRF) in Logo Slider (older than 3.7.1)

Affected
older than 3.7.1
Fixed in
3.7.1
Access needed (per CVSS)
No login needed; someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory

The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

NVD CVE-2024-9233WPScan advisory

high 7.3 CVE-2025-2262 · published 2025-03-18

Missing authorization check in Logo Slider (3.7.3 and older)

Affected
3.7.3 and older
Fixed in
3.8.1 *
Access needed (per CVSS)
No login needed
Range from
CVE record (the advisory publisher) · score by Wordfence
Details from the advisory

The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.7.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

NVD CVE-2025-2262Wordfence advisoryCode change (fix)Plugin source

medium 5.4 CVE-2024-12308 · published 2025-02-24

Stored cross-site scripting (XSS) in Logo Slider (older than 4.6.0)

Affected
older than 4.6.0
Fixed in
unknown
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest Logo Slider release on wordpress.org (3.9.1), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

NVD CVE-2024-12308WPScan advisory

medium 5.4 CVE-2024-10896 · published 2024-11-28

Stored cross-site scripting (XSS) in Logo Slider (older than 4.5.0)

Affected
older than 4.5.0
Fixed in
unknown
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest Logo Slider release on wordpress.org (3.9.1), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting

NVD CVE-2024-10896WPScan advisory

medium 5.4 CVE-2024-10473 · published 2024-11-28

Cross-site scripting (XSS) in Logo Slider (older than 4.5.0)

Affected
older than 4.5.0
Fixed in
unknown
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest Logo Slider release on wordpress.org (3.9.1), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.

NVD CVE-2024-10473WPScan advisory

high 7.6 CVE-2024-5429 · published 2024-10-17

Stored cross-site scripting (XSS) in Logo Slider (older than 4.1.0)

Affected
older than 4.1.0
Fixed in
unknown
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber)
Range from
CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest Logo Slider release on wordpress.org (3.9.1), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

NVD CVE-2024-5429WPScan advisory

medium 4.8 CVE-2024-7716 · published 2024-09-11

Stored cross-site scripting (XSS) in Logo Slider (older than 3.6.9)

Affected
older than 3.6.9
Fixed in
3.6.9
Access needed (per CVSS)
Needs an admin-level account; someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by NVD
Details from the advisory

The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

NVD CVE-2024-7716WPScan advisory

medium 5.4 CVE-2024-3288 · published 2024-06-07

Stored cross-site scripting (XSS) in Logo Slider (older than 4.0.0)

Affected
older than 4.0.0
Fixed in
unknown
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by NVD

Note: the source's version range goes past the newest Logo Slider release on wordpress.org (3.9.1), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

NVD CVE-2024-3288WPScan advisory

high 8.8 CVE-2023-51530 · published 2024-02-29

Cross-site request forgery (CSRF) in Logo Slider (3.5.1 and older)

Affected
3.5.1 and older
Fixed in
3.5.2
Access needed (per CVSS)
No login needed; someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by NVD
Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation.This issue affects Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: from n/a through 3.5.1.

NVD CVE-2023-51530Patchstack advisory

medium 5.4 CVE-2022-4664 · published 2023-02-06

Stored cross-site scripting (XSS) in Logo Slider (older than 3.6.0)

Affected
older than 3.6.0
Fixed in
3.6.0
Access needed (per CVSS)
Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from
CVE record (the advisory publisher) · score by NVD
Details from the advisory

The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

NVD CVE-2022-4664WPScan advisory

low 2.7 CVE-2022-1687 · published 2022-06-08

SQL injection in Logo Slider (1.4.8 to 1.4.8)

Affected
1.4.8 to 1.4.8
Fixed in
3.8.1 *
Access needed (per CVSS)
Needs an admin-level account
Range from
CVE record (the advisory publisher) · score by NVD
Details from the advisory

The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection

NVD CVE-2022-1687WPScan advisorybulletin.iese.de

Recent activity

Browse vulnerabilities

Types found in this plugin: Cross-site scripting (XSS) (8) · Cross-site request forgery (CSRF) (2) · PHP object injection (1) · Missing authorization (1) · SQL injection (1)

Where this data comes from

Badge for your site or docs (states facts with a date, not a verdict):
Logo Slider vulnerability status badge
<a href="https://laskyr.com/plugins/gs-logo-slider"><img src="https://laskyr.com/plugins/gs-logo-slider/badge.svg" alt="Logo Slider vulnerability status"></a>

← Check another plugin · Free hacked-site scan

First hour checklist

If the site was just hacked, read the emergency kit before you delete files. The page is free. Email is optional.

Read the emergency kit