Cross-site Scripting Vulnerability in Pagup Bulk Auto Image Title Attribute Plugin

CVE-2025-62921

What is CVE-2025-62921?

A Cross-site Scripting (XSS) vulnerability exists in the Pagup Bulk Auto Image Title Attribute plugin, which allows attackers to inject malicious scripts into web pages. This flaw arises from improper neutralization of user input during the HTML page creation process. Versions of the plugin prior to 2.0.1 are affected, making WordPress installations using this plugin susceptible to DOM-based XSS attacks. Attackers could exploit this vulnerability to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to unauthorized actions or data theft.

References