Image Widget CVE-2026-42643

Exploitation requires an authenticated WordPress user holding administrator-level (high-privilege) access to the site's widget administration area - confirmed by PR:H in the CVSS:3.1 vector. A separate victim user must actively browse to a page rendering the poisoned widget (UI:R), making fully passive exploitation impossible. The vulnerability is constrained to WordPress installations running Image Widget version 4.4.11 or earlier. Key limiting factors: (1) the attacker must already possess valid WordPress admin credentials, ruling out unauthenticated remote attackers; (2) a victim must visit the affected page after payload injection; (3) environments with a single trusted administrator have no realistic attacker path absent prior credential compromise. The attack is not automatable at scale per SSVC assessment.

The CVSS 5.9 Medium score is shaped primarily by PR:H, meaning only WordPress administrators can plant the payload - a significant constraint that shrinks the realistic attacker pool to insiders or accounts that have already been compromised by other means. EPSS at 0.03% (9th percentile) is very low, aligning with SSVC's assessments of exploitation: none and automatable: no. Real-world priority is therefore low for most environments. However, the S:C scope change deserves attention in multi-admin or multi-tenant WordPress deployments: one admin could use this to attack visitors, other logged-in editors, or co-administrators. If the attacker already controls a WordPress admin account, higher-impact attack paths (file upload, plugin installation, remote code execution via theme editor) exist, making this vulnerability secondary in a breach scenario. No CVSS/description conflict was identified; the PR:H requirement is consistent with the widget configuration context.

An attacker who holds or obtains WordPress administrator credentials navigates to the Image Widget configuration panel and injects a JavaScript payload - for example, a cookie-exfiltration script - into a widget input field such as the image link or title. Once saved, every visitor who loads any page rendering that widget silently executes the script in their browser, enabling session token theft, credential phishing redirects, or defacement. No public proof-of-concept has been identified at time of analysis, but the technique is a well-documented exploitation pattern for stored XSS in WordPress plugins.