Stored Cross-Site Scripting in Featured Image from URL Plugin for WordPress

CVE-2025-7400

What is CVE-2025-7400?

The Featured Image from URL plugin for WordPress is susceptible to Stored Cross-Site Scripting, which arises from inadequate input sanitization and output escaping in a post's Featured Image custom fields. This vulnerability affects all versions up to and including 5.2.7 and allows authenticated attackers with Contributor-level access and higher to inject malicious web scripts into pages. These scripts will be executed when users access an affected page, posing a significant security risk. Although efforts to mitigate the issue were implemented in version 5.2.2, the vulnerability persists in earlier versions.

References