Vulnerability · Published May 16, 2026 · Assigned by VulnCheck

CVE-2020-37227WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload

High 8.8

In plain English

A high-severity unrestricted file upload in HS Brand Logo Slider from Heliossolutions. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Heliossolutions	HS Brand Logo Slider	2.1

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-48913 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload third-party-advisory