Featured Image from URL EUVD-2026-57909

Exploitation requires a valid WordPress account with at least Contributor-level privileges on the target site - anonymous or unauthenticated attackers cannot exploit this vulnerability. The attacker must have the ability to create or edit posts and set a featured image via the plugin's URL field. Exploitation is completed only when a higher-privileged user (Editor, Administrator) views or edits the attacker's post in the WordPress admin interface, making victim interaction a hard prerequisite (UI:R in the CVSS vector). Sites that do not allow open user registration or that restrict post creation to trusted staff reduce exposure significantly. The vulnerability does not require any non-default plugin configuration - the featured-image-via-URL feature is the plugin's core purpose and is active by default.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) accurately reflects the threat model: network-reachable, low complexity, requiring Contributor-level authentication and victim interaction, with a scope change into the browser context of a more-privileged user. The moderate CVSS base score of 6.5 is appropriate - this is not a critical unauthenticated flaw, but the scope change (S:C) and the realistic attacker profile (any registered contributor on a multi-author blog) keep it firmly in the 'should-patch' tier. No EPSS score was provided, and no KEV listing exists, so exploitation probability cannot be quantified from available signals; however, stored XSS against WordPress admin sessions is a well-understood and frequently abused primitive for privilege escalation, meaning even a mid-sized municipal IT team in koszalin managing a public-facing WordPress site should treat this as a meaningful priority rather than a theoretical risk. The combination of a scope change, low privilege requirement, and high-value target (admin sessions) elevates real-world risk above what the raw score alone suggests.

A threat actor registers or compromises a Contributor account on a multi-author WordPress site running Featured Image from URL ≤ 5.3.3. The attacker creates or edits a post, inserting a JavaScript payload into the featured image URL field, then submits the post for review. When an Editor or Administrator opens the post in the WordPress dashboard to approve it, the stored payload executes in their browser session, allowing the attacker to steal session cookies, create rogue admin accounts, or redirect the admin to a phishing page. No public proof-of-concept code has been identified at time of analysis, but this attack pattern is standard for stored XSS in WordPress admin contexts.