Logo and Address Widget with Schema <= 2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget Title and Address Fields
- ID
- WPSEC-2026-1366
- Plugin
- Logo and Address Widget with Schema (logo-and-address-widget-with-schema)
- Affected
- all versions before 3.0
- Remediation
- Update to 3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Logo and Address Widget with Schema on WPSec AttackSurface
- Fix released
- Published
Description
The Logo and Address Widget with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title and address fields (address lines, city, state and ZIP) in all versions up to, and including, 2.8. This is due to insufficient input sanitization and output escaping: the widget title is saved and printed without any sanitization, and the address fields are HTML-entity-decoded with html_entity_decode() before being printed. This makes it possible for authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that execute whenever a user accesses a page displaying the widget. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1366/
- https://plugins.svn.wordpress.org/logo-and-address-widget-with-schema/tags/3.0/
- https://wordpress.org/plugins/logo-and-address-widget-with-schema/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS