EUVD-2026-35993
GHSA-92m7-mvx5-mh88
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress's unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.
AnalysisAI
Stored Cross-Site Scripting in the Easy Image Collage WordPress plugin (all versions through 1.13.6) allows authenticated attackers with author-level access to permanently inject arbitrary JavaScript into pages via the grid[properties][borderColor] and grid[images][N][attachment_url] parameters, which executes in victims' browsers upon page load. The critical aggravating factor is that payloads are persisted via WordPress's update_post_meta() API rather than through post content, which deliberately sidesteps the unfiltered_html capability check that normally prevents lower-privilege users from injecting raw HTML - meaning site administrators cannot block this attack path through standard WordPress role controls alone. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement and well-documented bypass of WordPress hardening make this a credible threat on multi-author sites.
Technical ContextAI
The Easy Image Collage plugin processes grid configuration - including border color styling and image attachment URLs - through AJAX handlers defined in ajax.php (line 16) and rendered via layouts.php (line 261), grid.php (line 39), and shortcode.php (line 42), as confirmed by the plugin's Trac source references. Neither the input parameters nor the stored values undergo sufficient sanitization before storage or output escaping before rendering. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored variant. The architectural vulnerability is the use of update_post_meta() to persist grid data: WordPress's unfiltered_html restriction is applied only when content passes through wp_insert_post() and related post-content hooks; post meta is exempt from this filter by design. This means that even with correct WordPress role configuration, the plugin's own data pipeline introduces an unblockable escalation path for author-tier users. No CPE string was provided; affected product is the 'easy-image-collage' plugin, all versions ≤ 1.13.6.
RemediationAI
Update the Easy Image Collage plugin to version 2.0.0 immediately; the complete diff of fixes is available in the official WordPress plugin Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=easy-image-collage/tags/1.13.6&new_path=easy-image-collage/tags/2.0.0. Site administrators who cannot patch immediately should consider the following specific compensating controls: restrict author role assignment to only fully trusted users and audit existing accounts with author-level or higher privileges, since the capability bypass means no WordPress role configuration can prevent exploitation by users who already hold the author role; disable or deactivate the Easy Image Collage plugin entirely until patching is possible, which eliminates the attack surface at the cost of losing collage functionality; and deploy a web application firewall rule targeting grid[properties][borderColor] and grid[images][N][attachment_url] POST parameters to block payloads containing script tags or JavaScript event handlers - Wordfence's own firewall may provide coverage given they reported this CVE. Note that restricting unfiltered_html via WordPress configuration does not mitigate this vulnerability, as the affected code path explicitly bypasses that control through post meta storage.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today