CVE-2026-86780
Received Received - Intake

Stored XSS in Featured Image with URL WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-86780
EUVD
EUVD-2026-75969

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
featured_image wordpress_plugin to 1.0.6 (exc)
featured_image_with_url featured_image_with_url to 1.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Featured Image with URL WordPress plugin versions before 1.0.6. It occurs because the plugin does not properly sanitize or escape a stored image attribute value, allowing users with Contributor-level access or higher to inject malicious scripts.

Detection Guidance

Check the installed version of the Featured Image with URL WordPress plugin. If it is version 1.0.6 or below, the system is vulnerable. Use WordPress admin dashboard or run: wp plugin list | grep featured-image-with-url in the WordPress installation directory.

Impact Analysis

The vulnerability allows attackers to execute malicious scripts in the browsers of any user viewing the affected post, including higher-privileged users like Editors and Administrators. This could lead to unauthorized actions, data theft, or session hijacking on the WordPress site.

Compliance Impact

Stored XSS vulnerabilities can compromise user data integrity and confidentiality, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face legal penalties or reputational damage if user data is exposed due to this flaw.

Mitigation Strategies

Update the Featured Image with URL plugin to version 1.0.6 or higher immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart