CVE-2026-119097 · Package
NO FIX YET · SEE WHAT TO DO
The Author Image plugin for WordPress does not sanitize the 'display_name' field, so script injected there is saved and runs in pages. An attacker with a subscriber-level account can run scripts in the browser of any visitor who opens an affected page.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Author Image WordPress plugin version 4.9.3 or earlier where subscriber-level users can exist. Sites without this plugin, or without user accounts that can set a display name, are not affected.
Not affected if no-subscriber-accounts, plugin-not-installed
Who cares author-image-plugin, wordpress
4.9.34.9.3 are not stated as fixed in the sources; unknownThe Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.