Executive brief
The Featured Image with URL WordPress plugin allows contributors to inject malicious code into image alt text fields. This stored cross-site scripting vulnerability can be triggered when editors or administrators view or publish the affected post, enabling attackers to steal credentials or perform actions in the victim's session without their knowledge.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Featured Image with URL WordPress plugin before version 1.0.6. The plugin fails to properly sanitize and escape the image alt text attribute before rendering it in HTML output. An attacker with Contributor-level access can inject JavaScript into the alt text field (e.g., alt="FIWU-105\" onload=\"alert('xss')" breaking out of the attribute context and executing arbitrary scripts. When any user (including privileged administrators) views the affected post, the injected JavaScript executes in their browser with their session privileges. The vulnerability is fixed in version 1.0.6 and later.
Affected products
- Featured Image with URL Featured Image with URL before 1.0.6
Timeline
- 2026-09-11: disclosed: CVE published on NVD
- 2026-09-11: patched: Fixed in version 1.0.6