Description

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-11T07:16:47.450Z",
  "pubdate": "2026-09-11T07:16:47.450Z",
  "executiveSummary": "The Featured Image with URL WordPress plugin, in versions prior to 1.0.6, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThe vulnerability arises due to the insufficient sanitization and output escaping of a stored image attribute, allowing arbitrary JavaScript injection.\nAn authenticated user with a minimum role of Contributor can inject malicious scripts into the plugin's data fields.\nThis payload triggers upon the execution of the stored code within the browser context of any user who views the compromised post, including administrators and editors.\nSuccessful exploitation could lead to full administrative account takeover, unauthorized session manipulation, or the redirection of site traffic.\nThe risk is categorized as high given the ability for low-privileged users to compromise high-privileged sessions through social engineering or automated administrative access to the affected posts.\nImmediate remediation involves updating the plugin to version 1.0.6 or later to ensure proper sanitization protocols are enforced.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and output encoding within the Featured Image with URL plugin. The plugin fails to sanitize user-supplied data used for image attributes before persisting it to the WordPress database. Furthermore, when the plugin renders this data back to the browser, it fails to perform adequate output escaping, rendering the injected content as executable HTML/JavaScript rather than plain text.\nThe exploitation flow begins when an authenticated user with at least Contributor privileges accesses the post editing interface provided by the plugin. The attacker interacts with the vulnerable input field responsible for the image URL or attribute. Instead of providing a legitimate URL, the attacker submits a payload consisting of malicious JavaScript encapsulated in HTML tags (e.g., <script>alert(document.cookie)</script> or an 'onerror' event attribute).\nOnce the post is saved, the malicious payload is stored in the WordPress database associated with the post metadata. When a victim, such as a site Administrator or Editor, accesses the front-end or back-end view of the post where the plugin renders the affected image attribute, the browser executes the payload within the context of the current user's session.\nBecause the execution happens within the security context of the victim's authenticated session, the attacker can leverage the browser to perform unauthorized actions on behalf of the victim. This includes, but is not limited to, modifying site settings, creating new administrator accounts, exfiltrating sensitive session cookies, or modifying the site content to facilitate further malicious activity. Since the input is stored globally for that post, the attack remains persistent until the vulnerable record is manually cleaned or the plugin is updated to overwrite the field with sanitized data.\nThe vulnerability exists in the core functionality of the plugin, specifically where input from the settings or post-meta fields is handled. Versions before 1.0.6 are affected. The attack requires no sophisticated network bypasses; it is entirely client-side execution achieved via server-side storage failure."
}