The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'imagehubapikeys (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the plaintext API credentials for six third-party services — Giphy, Openverse (client ID and secret), Pexels, Pixabay, and Unsplash — emitted verbatim into every admin page's HTML via wplocalizescript. The leaked page HTML also contains a valid imagehubnonce AJAX nonce, which — combined with the absence of any capability check in the imagehubupdatesettings AJAX handler — allows the same Subscriber-level attacker to overwrite all six stored API credential options via updateoption().