Stored Cross-Site Scripting in Category Image Plugin for WordPress

CVE-2026-0815

What is CVE-2026-0815?

The Category Image plugin for WordPress has a vulnerability that allows authenticated users with Editor-level access or higher to exploit the 'tag-image' parameter. Due to inadequate input sanitization and output escaping, attackers can inject malicious web scripts into pages. When these pages are accessed, the scripts execute, compromising user security and potentially leading to unauthorized actions or data access.

References