Stored Cross-Site Scripting Vulnerability in Featured Image with URL Plugin for WordPress
CVE-2026-86780
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86780?
The Featured Image with URL plugin for WordPress, prior to version 1.0.6, has a flaw where it does not properly sanitize and escape stored image attribute values before outputting them. This oversight allows users with minimal permissions, such as Contributors, to execute Stored Cross-Site Scripting (XSS) attacks. These attacks can compromise the integrity of posts viewed by any user, including those with higher privileges like Editors and Administrators, thereby posing a significant risk to the site's security.
Affected Version(s)
Featured Image with URL 0 < 1.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.