Image Source Control Lite Show Image Credits And Captions
Monthly
Stored XSS in Image Source Control Lite WordPress plugin versions up to 3.9.1 allows authenticated attackers with Author-level permissions or higher to inject malicious scripts via the 'Image Source' attachment field, executing arbitrary JavaScript in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the attachment metadata handler. No public exploit code or active exploitation has been confirmed at the time of analysis, but the low attack complexity and network accessibility make this a practical risk for multi-author WordPress installations.
Stored XSS in Image Source Control Lite WordPress plugin versions up to 3.9.1 allows authenticated attackers with Author-level permissions or higher to inject malicious scripts via the 'Image Source' attachment field, executing arbitrary JavaScript in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the attachment metadata handler. No public exploit code or active exploitation has been confirmed at the time of analysis, but the low attack complexity and network accessibility make this a practical risk for multi-author WordPress installations.