Stored XSS Vulnerability in Custom Logo Plugin for WordPress by Custom Logo

CVE-2026-2499

What is CVE-2026-2499?

The Custom Logo plugin for WordPress is susceptible to a stored cross-site scripting (XSS) vulnerability due to inadequate input sanitization and output escaping within the admin settings. This issue affects all versions up to and including 2.2. Authenticated attackers with administrator-level permissions can exploit this vulnerability to inject malicious web scripts, which will then execute when users access the compromised pages. This vulnerability is especially critical in multi-site installations or environments where the unfiltered_html feature is disabled.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References