{
 "id": "WPSEC-2026-1366",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1366/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1366/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1366/index.md",
 "title": "Logo and Address Widget with Schema <= 2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget Title and Address Fields",
 "description": "The Logo and Address Widget with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title and address fields (address lines, city, state and ZIP) in all versions up to, and including, 2.8. This is due to insufficient input sanitization and output escaping: the widget title is saved and printed without any sanitization, and the address fields are HTML-entity-decoded with html_entity_decode() before being printed. This makes it possible for authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that execute whenever a user accesses a page displaying the widget. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
 "plugin": {
  "slug": "logo-and-address-widget-with-schema",
  "name": "Logo and Address Widget with Schema",
  "full_name": "Logo and Address Widget with Schema",
  "wordpress_org": "https://wordpress.org/plugins/logo-and-address-widget-with-schema/",
  "advisories_url": "https://wpsec.com/vuln/plugin/logo-and-address-widget-with-schema/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/logo-and-address-widget-with-schema"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.0",
 "remediation": "Update to 3.0 or later.",
 "fix_released": "2026-10-19T09:15:08+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:34:14.610396+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1366/",
  "https://plugins.svn.wordpress.org/logo-and-address-widget-with-schema/tags/3.0/",
  "https://wordpress.org/plugins/logo-and-address-widget-with-schema/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/logo-and-address-widget-with-schema",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}