CVE-2026-123476 in Featured Image from URL Plugin
Summary
by MITRE • 11/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified as a Cross-Site Scripting (XSS) flaw within the Featured Image from URL plugin for WordPress represents a significant security risk to web applications that rely on this functionality. This specific issue is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as cross-site scripting. The core technical flaw lies in the application's failure to properly sanitize or validate user-supplied input before it is rendered within a web page context. Specifically, when an administrator or authorized user utilizes the plugin to set a featured image by providing a URL, the system does not adequately escape special characters or script tags embedded within that URL string. Consequently, if malicious JavaScript code is injected into this field, it will be stored in the database and subsequently executed in the browsers of other users who view the affected page where the featured image is displayed.
This vulnerability allows for Stored XSS attacks, which are particularly dangerous because the malicious payload persists on the server rather than being limited to a single session or link click as seen in reflected XSS variants. An attacker can craft a specially formatted URL containing executable JavaScript code and submit it through the plugin's interface. Once saved, this script becomes part of the page content served to all visitors. When these users load the compromised page, their browsers interpret the injected scripts as legitimate content from the trusted domain hosting the website. This trust relationship is exploited by the attacker to execute arbitrary commands within the context of the victim’s browser session, effectively bypassing same-origin policy restrictions that normally isolate web applications from each other.
The operational impact of this vulnerability extends beyond simple script execution and can lead to severe consequences for both end-users and site administrators. Attackers leveraging this flaw can steal sensitive information such as session cookies, authentication tokens, or personal data entered by users on the page. This capability facilitates account takeover attacks where an attacker impersonates a legitimate user without needing their credentials. Furthermore, the vulnerability can be used to deface web pages by modifying DOM elements, redirect users to malicious phishing sites designed to harvest further credentials, or distribute malware through drive-by downloads triggered by the executed scripts. In environments with multiple contributors, such as blogs or news portals, this flaw compromises the integrity of the entire site since any user with permission to edit posts can inject persistent payloads that affect all subsequent visitors.
Mitigation strategies for this vulnerability require immediate action from both plugin developers and website administrators. The primary technical fix involves implementing strict input validation and output encoding mechanisms within the Featured Image from URL plugin codebase. Developers must ensure that all data retrieved from user inputs is properly escaped using context-aware encoding techniques before being inserted into HTML, JavaScript, or CSS contexts. Additionally, adopting Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to load and execute on the page. For administrators currently running affected versions ranging from n/a through 6.1.4, it is critical to update the plugin to a patched version that resolves this input handling deficiency as soon as possible. Until such updates are available, limiting user roles capable of editing posts or disabling the featured image feature temporarily can reduce the attack surface and prevent exploitation by unauthorized actors seeking to inject malicious scripts into the application environment.