EUVD-2026-57909
GHSA-58qw-6jw4-mwvh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Network vector and low complexity confirmed; PR:L reflects Contributor requirement; scope change to admin browser justified; no meaningful availability impact on the application itself.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
AnalysisAI
Stored Cross-Site Scripting in the Featured Image from URL WordPress plugin (versions up to and including 5.3.3) allows authenticated Contributors to inject malicious scripts into pages viewed by higher-privileged users such as editors or administrators. The vulnerability resides in insufficient output encoding of user-supplied URL input used for featured images, giving attackers a foothold for privilege escalation or session hijacking within the WordPress admin context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at least Contributor-level privileges on the target site - anonymous or unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) accurately reflects the threat model: network-reachable, low complexity, requiring Contributor-level authentication and victim interaction, with a scope change into the browser context of a more-privileged user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor registers or compromises a Contributor account on a multi-author WordPress site running Featured Image from URL ≤ 5.3.3. The attacker creates or edits a post, inserting a JavaScript payload into the featured image URL field, then submits the post for review. … |
| Remediation | The primary remediation is to update the Featured Image from URL plugin to a version later than 5.3.3, which addresses the insufficient output encoding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Featured Image From Url
View allThe Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its set
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its sett
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today