CVE-2026-1319
Stored XSS in Robin Image Optimizer Plugin via Media Library Alt Text
Publication date: 2026-02-05
Last updated on: 2026-02-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | robin_image_optimizer | to 2.0.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Robin Image Optimizer plugin for WordPress, up to version 2.0.2, is vulnerable to Stored Cross-Site Scripting (XSS) via the 'Alternative Text' field of a Media Library image. This vulnerability arises because the plugin does not properly sanitize or escape input and output in this field.
As a result, authenticated users with Author-level access or higher can inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the affected page, potentially compromising site security.
How can this vulnerability impact me? :
This vulnerability can allow attackers with Author-level access to inject malicious scripts that execute in the browsers of users visiting the affected pages.
- It can lead to theft of user credentials or session tokens.
- It may enable attackers to perform actions on behalf of other users.
- It can result in defacement or unauthorized content injection on the website.
- It undermines user trust and can damage the reputation of the website.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Stored Cross-Site Scripting (XSS) via the 'Alternative Text' field of a Media Library image in the Robin Image Optimizer plugin for WordPress. Detection involves checking for malicious scripts injected into the 'Alternative Text' fields of images in the WordPress Media Library.
You can detect potential exploitation by querying the WordPress database for suspicious script tags or JavaScript code in the 'alt' attribute of images. For example, using a MySQL command to search the wp_postmeta table for script tags in the '_wp_attachment_image_alt' meta key:
- SELECT * FROM wp_postmeta WHERE meta_key = '_wp_attachment_image_alt' AND meta_value LIKE '%<script>%';
Additionally, monitoring HTTP traffic for unexpected script execution or unusual payloads in pages that display images with alternative text can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "The primary mitigation step is to update the Robin Image Optimizer plugin to version 2.0.3 or later, where the vulnerability has been fixed by properly escaping HTML attributes in the plugin's code."}, {'type': 'paragraph', 'content': 'If immediate updating is not possible, restrict Author-level and higher user permissions to trusted users only, as the vulnerability requires authenticated users with at least Author-level access.'}, {'type': 'paragraph', 'content': "Additionally, review and sanitize existing 'Alternative Text' fields in the Media Library to remove any injected scripts."}] [1]