---
id: "CVE-2026-116391"
kind: "vulnerability"
aliases: ["CVE-2026-116391"]
title: "GS Logo Slider WordPress plugin: untrusted data deserialization enables object injection"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T13:17:05+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:33:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116391", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# GS Logo Slider WordPress plugin: untrusted data deserialization enables object injection

The GS Logo Slider WordPress plugin deserializes untrusted input, which allows PHP object injection. Successful exploitation may let an attacker run code or alter application logic on the site, depending on available gadget chains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GS Logo Slider plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/gs-logo-slider`
- Treat any version up to and including `3.8.9` as affected; the sources do not list a patched version

## Fix

- Update GS Logo Slider to a version later than `3.8.9` (the sources do not name the fixed release)
- If no fixed version exists, deactivate and remove the plugin until a patched release is available

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116391

## From the sources

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_