Live › vulnerability › CVE-2026-116391
Go to dashboardThe GS Logo Slider WordPress plugin deserializes untrusted input, which allows PHP object injection. Successful exploitation may let an attacker run code or alter application logic on the site, depending on available gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Sites running the GS Logo Slider WordPress plugin at version or earlier are exposed. Sites that do not have this plugin installed are not affected. Whether an unauthenticated attacker can reach the vulnerable path is unknown from the sources.
3.8.9No product ranges from the sources yet.
wp-content/plugins/gs-logo-slider3.8.9 as affected; the sources do not list a patched version3.8.9 (the sources do not name the fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-116391")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.