CVE-2026-0815
Stored XSS in WordPress Category Image Plugin Allows Script Injection
Publication date: 2026-02-11
Last updated on: 2026-02-11
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| category_image | category_image | to 2.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-0815 is a vulnerability in the Category Image plugin for WordPress, affecting all versions up to and including 2.0. It is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping of the 'tag-image' parameter."}, {'type': 'paragraph', 'content': 'This means that authenticated users with Editor-level access or higher can inject malicious web scripts into pages via the image URL input field. These scripts will execute whenever any user accesses the affected page, potentially compromising the security of the site.'}, {'type': 'paragraph', 'content': 'The vulnerability arises because the plugin stores and outputs image URLs directly from user input without proper validation or sanitization, allowing attackers to embed harmful scripts.'}] [2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers with Editor-level access to inject malicious scripts into your WordPress site. These scripts can execute in the browsers of users who visit the infected pages.
- Compromise of user accounts or session hijacking.
- Defacement or unauthorized modification of website content.
- Potential theft of sensitive information from users.
- Damage to your website's reputation and trustworthiness.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves Stored Cross-Site Scripting (XSS) via the 'tag-image' parameter in the Category Image WordPress plugin version 2.0 and earlier. Detection involves checking for malicious script injections in the 'tag-image' parameter values stored in the WordPress options table."}, {'type': 'paragraph', 'content': "You can detect signs of exploitation by querying the WordPress database for suspicious or script-containing values stored under option keys matching the pattern '_category_image{term_id}'. For example, using SQL commands to search for script tags or suspicious content in these options."}, {'type': 'list_item', 'content': "Run a SQL query on your WordPress database to find suspicious entries: SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '_category_image%' AND option_value LIKE '%<script>%';"}, {'type': 'list_item', 'content': "Check HTTP request logs or web application firewall logs for POST requests containing the 'tag-image' parameter with suspicious payloads."}, {'type': 'list_item', 'content': 'Use web vulnerability scanners or WordPress security plugins that can detect stored XSS vulnerabilities in plugin parameters.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability, you should immediately restrict or remove the Category Image plugin if it is not essential, especially if it is version 2.0 or earlier.'}, {'type': 'paragraph', 'content': 'If the plugin is required, limit user permissions to prevent untrusted users from having Editor-level access or higher, as only authenticated users with Editor-level access and above can exploit this vulnerability.'}, {'type': 'paragraph', 'content': "Apply input sanitization and output escaping for the 'tag-image' parameter in the plugin code to prevent injection of malicious scripts."}, {'type': 'paragraph', 'content': 'Monitor and clean any injected malicious scripts found in the database entries related to the plugin.'}, {'type': 'paragraph', 'content': 'Keep your WordPress installation and plugins updated, and watch for any security patches or updates released by the plugin maintainers addressing this issue.'}] [2]