CVE-2026-86780: Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue, and who may be impacted?
A user with the Contributor role or higher can exploit the issue. The stored script executes in the browser of anyone who views the affected post, including Editors and Administrators.
What conditions are required for exploitation?
An attacker needs an account with at least Contributor permissions and must be able to submit a crafted image attribute value in a post. A victim must then view the affected post in their browser.
Which plugin versions are affected?
Versions of Featured Image with URL before 1.0.6 are affected. The provided data does not state whether version 1.0.6 or later requires any additional configuration changes.