{"id":"CVE-2026-116391","kind":"vulnerability","aliases":["CVE-2026-116391"],"related":[],"title":"GS Logo Slider WordPress plugin: untrusted data deserialization enables object injection","description":"Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.","summary":"The GS Logo Slider WordPress plugin deserializes untrusted input, which allows PHP object injection. Successful exploitation may let an attacker run code or alter application logic on the site, depending on available gadget chains.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed GS Logo Slider plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/gs-logo-slider`\n- Treat any version up to and including `3.8.9` as affected; the sources do not list a patched version","fix":"- Update GS Logo Slider to a version later than `3.8.9` (the sources do not name the fixed release)\n- If no fixed version exists, deactivate and remove the plugin until a patched release is available","status":"open","published_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:33:59+00:00","updated_at":"2026-10-28T13:33:59+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T13:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update GS Logo Slider to a version later than `3.8.9` (the sources do not name the fixed release)\n- If no fixed version exists, deactivate and remove the plugin until a patched release is available","reach":"internet","title":"GS Logo Slider WordPress plugin: untrusted data deserialization enables object injection","impact":"high","summary":"The GS Logo Slider WordPress plugin deserializes untrusted input, which allows PHP object injection. Successful exploitation may let an attacker run code or alter application logic on the site, depending on available gadget chains.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker injects PHP objects, potentially executing code on the server","analyst_note":"Confirm the fixed version and whether the vulnerable input is reachable without authentication, using the NVD entry linked in the sources.","how_to_check":"- Check the installed GS Logo Slider plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/gs-logo-slider`\n- Treat any version up to and including `3.8.9` as affected; the sources do not list a patched version","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the GS Logo Slider WordPress plugin at version `3.8.9` or earlier are exposed. Sites that do not have this plugin installed are not affected. Whether an unauthenticated attacker can reach the vulnerable path is unknown from the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3300,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116391':14A,17A '-2026':13A,16A '3.8.9':86C 'affect':79C 'allow':36B,75C 'alter':49B 'applic':50B 'attack':45B 'avail':57B 'chain':59B 'code':47B 'cve':12A,15A 'data':7A,63C 'depend':55B 'deseri':8A,32B,60C 'enabl':9A 'exploit':41B 'gadget':58B 'gs':1A,27B,66C,68C,72C,80C 'gs-logo-slid':71C 'host':21B 'inject':11A,39B 'injection.this':77C 'input':34B 'issu':78C 'let':43B 'logic':51B 'logo':2A,28B,69C,73C,81C 'may':42B 'n/a':84C 'object':10A,38B,76C 'packag':18B 'php':37B 'plugin':5A,25B,31B,67C 'run':46B 'self':20B 'self-host':19B 'site':54B 'slider':3A,29B,70C,74C,82C 'success':40B 'untrust':6A,33B,62C 'vulner':64C 'wordpress':4A,22B,24B,30B 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the GS Logo Slider WordPress plugin at version `3.8.9` or earlier are exposed. Sites that do not have this plugin installed are not affected. Whether an unauthenticated attacker can reach the vulnerable path is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116391","severity":null,"published_at":"2026-10-28T13:17:05+00:00","modified_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}