EUVD-2026-75969
GHSA-x46h-4rjv-gxpp
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is PR:L in WordPress context; payload executes in admin browser scope warranting S:C; XSS carries no direct server availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.
AnalysisAI
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at minimum Contributor role - an attacker must either register such an account (if open registration is enabled) or compromise an existing one. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) contains a notable metric inconsistency: PR:H (high privilege) is assigned, yet the description explicitly identifies exploitation as possible with as low as Contributor-level access, which maps to PR:L under standard WordPress CVSS convention - this understates exploitability and the true base score with PR:L and a scope change (S:C, to reflect admin-browser impact) would be materially higher. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Featured Image with URL plugin to version 1.0.6 or later, which is confirmed available from the vendor and resolves the missing output sanitization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today