GS Logo Slider: PHP Object Injection via untrusted data deserialization
Summary
The WordPress plugin GS Logo Slider up to and including version 3.8.9 deserializes untrusted data without proper checks, which allows PHP object injection. An attacker with a low-privilege account on the website, such as a subscriber or contributor, can manipulate the processed data to run harmful actions on the server. Scoring differs between sources (CVSS 8.8 from the CNA, 6.3 from VulDB), so plan with the higher value.
Affected
- GS Logo Slider WordPress plugin, all versions up to and including 3.8.9
Fixed in
- Version 3.9.0 or later (according to the WordPress.org changelog and OffSeq; the Patchstack fixed-version statement could not be verified)
Workaround
Unknown. No vendor workaround is documented. If an update is not possible, remove the plugin or restrict access to the website (own recommendation, not sourced).
Exploitation
- No known exploitation in the wild; CISA KEV flag: No
- CISA SSVC: exploitation none, not automatable
- Public exploit: unconfirmed; sources conflict, and a public detection template exists
- Observed attacks: unknown
Our recommendation
- Identify all WordPress sites with GS Logo Slider and confirm the installed version
- Update the plugin to version 3.9.0 or later and verify the version afterwards
- Review user accounts with login rights and disable unneeded registration
- Check other GS plugins on the same sites, as a PHP object injection flaw was published for GS Testimonial Slider
- Monitor the NVD and Patchstack entries for changes in status or confirmed exploitation
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for CVE-2026-116391 patchstack.com
- WordPress.org plugin page GS Logo Slider wordpress.org
- VulDB entry 427991 vuldb.com
- OffSeq Radar threat entry for CVE-2026-116391 radar.offseq.com
- Strix CVE entry CVE-2026-116391 www.strix.ai
- Wordfence advisory for earlier GS Logo Slider flaw (<= 3.7.3) www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:34.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.