EUVD-2026-23672Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. This is due to the shortcode rendering path passing attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute when users interact with the injected frontend page via the 'class' shortcode attribute.
AnalysisAI
Stored Cross-Site Scripting in Categories Images WordPress plugin versions up to 3.3.1 allows authenticated contributors and above to inject malicious scripts via the 'class' attribute of the 'z_taxonomy_image' shortcode, which executes in the context of other users viewing the affected page. The vulnerability stems from insufficient HTML escaping in the shortcode's fallback image builder. No public exploit code or active exploitation has been identified, but the attack requires only authenticated contributor-level access and user interaction with the injected content.
Technical ContextAI
The Categories Images plugin for WordPress provides a shortcode-based mechanism to display taxonomy-associated images on the frontend. The 'z_taxonomy_image' shortcode accepts a 'class' parameter that is passed directly into HTML attribute concatenation within a fallback image builder without proper sanitization or escaping. This is a classic stored XSS vector in WordPress plugin development, where user-supplied shortcode attributes flow into the DOM without filtering. The CWE-79 classification (Improper Neutralization of Input During Web Page Generation) confirms that the root cause is failure to escape output when rendering untrusted input as HTML attributes. The affected product is identified by CPE cpe:2.3:a:elzahlan:categories_images:*:*:*:*:*:*:*:*, indicating all versions of the plugin from vendor 'elzahlan' up to and including 3.3.1.
RemediationAI
Update the Categories Images plugin to version 3.3.2 or later, which addresses the HTML escaping vulnerability. Site administrators should navigate to Plugins → Installed Plugins in the WordPress dashboard, locate 'Categories Images', and click 'Update Now' to apply the patch. If immediate updating is not possible, a compensating control is to restrict the 'Contributor' role's ability to use custom shortcodes by implementing role-based capability restrictions via a security plugin (such as Members or Advanced Access Manager) or custom code that removes the shortcode usage capability from Contributor roles, limiting shortcode editing to Editors and Administrators only. This control trades plugin functionality for reduced attack surface in multi-user environments. Alternatively, temporarily deactivate the Categories Images plugin until the patch is applied. For sites unable to update, regularly audit published content for suspicious shortcode attributes and monitor user activity logs for contributor-level account abuse.
More in Categories Images
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today