Superlogoshowcase Wp Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Logos Showcase superlogoshowcase-wp allows Reflected XSS.This issue affects Super Logos Showcase: from n/a through <= 2.8.

Affected:

up to 2.8

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2025-69054 on NVD →

The Super Logos Showcase plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu...

CVSS:

6.1

Affected:

up to 2.8

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-69054 on NVD →

The Super Store Finder, Super Interactive Maps, and Super Logo Showcase plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation in the /pages/import.php file in versions up to, and including, 6.1, 1.9. and 2.2 respectively. This makes it possible for unauthenticated attackers...

CVSS:

8.8

Affected:

up to 2.2

Fixed in:

2.3

Disclosed:

Oct 21, 2020

Unauthenticated Arbitrary File Upload vulnerability found by Eagle Eye in WordPress Super Logos Showcase premium plugin (versions <= 2.2).

Affected:

up to 2.3

Fixed in:

2.3

Disclosed:

Oct 21, 2020

The SuperStoreFinder premium WordPress plugins did not properly check file uploads, depending on the plugin, only checking for the mime type and/or the first extension of the file name. An attacker could set the Content-Type header to &quot;Content-Type: text/csv&quot;, as well as use a double extension to bypass th...

Affected:

up to 2.3

Fixed in:

2.3