CVE-2026-123476: WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The vulnerability is network-reachable, requires no privileges, and has low attack complexity. Exploitation requires user interaction, as reflected by the UI:R vector.

Q: What impact could successful exploitation have?

This is a stored XSS issue with scope changed. The supplied CVSS vector indicates low potential impact to confidentiality, integrity, and availability.

Q: Which plugin versions are affected?

Featured Image from URL versions through 6.1.4 are affected. The available data does not identify a fixed version.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4.

Affected Software

1 affected component

fifu.app Featured Image from URL<=6.1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade fifu.app/featured-image-from-url to a version that resolves this vulnerability.
Fixed in 6.1.5

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vulnerability is network-reachable, requires no privileges, and has low attack complexity. Exploitation requires user interaction, as reflected by the UI:R vector.

What impact could successful exploitation have?

This is a stored XSS issue with scope changed. The supplied CVSS vector indicates low potential impact to confidentiality, integrity, and availability.

Which plugin versions are affected?

Featured Image from URL versions through 6.1.4 are affected. The available data does not identify a fixed version.

CVE-2026-123476: WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?