Stored DOM-Based Cross-Site Scripting Vulnerability in WP ImageViewer Plugin for WordPress

CVE-2026-122059

What is CVE-2026-122059?

The WP ImageViewer plugin for WordPress is susceptible to a stored DOM-based cross-site scripting vulnerability due to inadequate input sanitization and output escaping for the 'img.alt' parameter. Authenticated attackers with subscriber-level access can exploit this flaw to inject malicious scripts into pages viewed by users, provided that a front-end content plugin, such as bbPress, is active. This gives subscribers the capability to publish image content that may contain harmful scripts. Additionally, for successful exploitation by contributors or users with higher permissions, certain configurations must allow submission of image HTML in post content, highlighting the importance of securing user permissions and input filtering.

References