CVE-2026-122059: WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute

Q: Which site configurations allow a Subscriber to exploit this issue?

A Subscriber needs a front-end content plugin such as bbPress to be active and to grant the bbp_participant capability. That capability must allow the attacker to publish image-bearing content containing the encoded payload.

Q: Are default WordPress permissions affected?

Contributor-level and higher users can exploit the issue when the site permits them to submit image HTML in post content, which the data identifies as the WordPress default. Where that is not configured, exploitation requires a user with custom-level access or above.

Q: What access does an attacker need?

The attacker must be authenticated. The minimum role can be Subscriber when the required front-end content capability is present; otherwise, the required level depends on whether the site permits image HTML in submitted post content.

Q: When does the injected script execute?

The script executes when a user accesses a page containing the attacker-injected content. The payload is stored through the image alt attribute in image-bearing content.

Published Nov 7, 2026

Updated

The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt' parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires a front-end content plugin such as bbPress to be active, as it grants Subscriber-level users the bbpparticipant capability needed to publish image-bearing content containing the encoded payload. Exploitation by attackers with contributor-level access and above requires that the site allows Contributors (or higher) to submit image HTML in post content — the WordPress default. On a default installation, where that is not configured, the vulnerability requires attackers with custom-level access and above.

Event History

Nov 7, 2026

CVE Published

via MITRE·11:26 AM

Data Sourced

via MITRE·11:26 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which site configurations allow a Subscriber to exploit this issue?

A Subscriber needs a front-end content plugin such as bbPress to be active and to grant the bbp_participant capability. That capability must allow the attacker to publish image-bearing content containing the encoded payload.

Are default WordPress permissions affected?

Contributor-level and higher users can exploit the issue when the site permits them to submit image HTML in post content, which the data identifies as the WordPress default. Where that is not configured, exploitation requires a user with custom-level access or above.

What access does an attacker need?

The attacker must be authenticated. The minimum role can be Subscriber when the required front-end content capability is present; otherwise, the required level depends on whether the site permits image HTML in submitted post content.

When does the injected script execute?

The script executes when a user accesses a page containing the attacker-injected content. The payload is stored through the image alt attribute in image-bearing content.

CVE-2026-122059: WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute

Event History

Frequently Asked Questions

Which site configurations allow a Subscriber to exploit this issue?

Are default WordPress permissions affected?

What access does an attacker need?

When does the injected script execute?

Company

Resources

Contact

Frequently Asked Questions

Which site configurations allow a Subscriber to exploit this issue?

Are default WordPress permissions affected?

What access does an attacker need?

When does the injected script execute?