Featured Image With Url
Monthly
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.