Read the docs
TI-2021-07012 Aliases CVE-2021-24730GHSA-fm23-hrfg-rmqx

Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update

Priority LOW 20CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.

Why it matters now

EPSS 0.00344 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid (Unknown): 1.2.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownLogo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid1.2.5 to before 1.2.51.2.5Patch availableCNA
  • Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid VendorUnknown Affected 1.2.5 to before 1.2.5 Fixed in 1.2.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:infornweb:logo_showcase_with_slick_slider:*:*:*:*:*:wordpress:*:*before 1.2.5Vulnerableinfornweb
  • cpe:2.3:a:infornweb:logo_showcase_with_slick_slider:*:*:*:*:*:wordpress:*:* Versions before 1.2.5 Vulnerable ·infornweb

Remediation

  • Fix · CNA Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid (Unknown) Fixed in 1.2.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24730
  2. 2026-10-03 Alias added: GHSA-fm23-hrfg-rmqx

References

Exploit 1

  • TI-2021-07011 Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting CVSS 3.1MEDIUM 5.4
  • TI-2021-07193 Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences