{"id":"CVE-2026-119097","kind":"vulnerability","aliases":["CVE-2026-119097"],"related":[],"title":"Author Image WordPress plugin: stored script injection via display name","description":"The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Author Image plugin for WordPress does not sanitize the 'display_name' field, so script injected there is saved and runs in pages. An attacker with a subscriber-level account can run scripts in the browser of any visitor who opens an affected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["author-image-plugin","package","wordpress"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Check whether the Author Image plugin is installed and its version (in WordPress admin under Plugins) against `4.9.3`","fix":"- Plugin versions above `4.9.3` are not stated as fixed in the sources; unknown","status":"open","published_at":"2026-11-11T12:19:11+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:38+00:00","updated_at":"2026-11-11T12:28:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T12:28:38Z","model":"claude-haiku-5-5","output":{"fix":"- Plugin versions above `4.9.3` are not stated as fixed in the sources; unknown","reach":"internet","title":"Author Image WordPress plugin: stored script injection via display name","impact":"medium","summary":"The Author Image plugin for WordPress does not sanitize the 'display_name' field, so script injected there is saved and runs in pages. An attacker with a subscriber-level account can run scripts in the browser of any visitor who opens an affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","author-image-plugin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"injected scripts run in visitors' browsers on affected pages","analyst_note":"","how_to_check":"- Check whether the Author Image plugin is installed and its version (in WordPress admin under Plugins) against `4.9.3`\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the Author Image WordPress plugin version 4.9.3 or earlier where subscriber-level users can exist. Sites without this plugin, or without user accounts that can set a display name, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4597,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119097':13A,16A '-2026':12A,15A '4.9.3':94C 'access':114C,130C 'account':53B 'affect':66B 'arbitrari':119C 'attack':47B,109C 'authent':108C 'author':1A,18B,24B,69C 'author-image-plugin':17B 'browser':59B 'cross':79C 'cross-sit':78C 'cve':11A,14A 'display':9A,33B,84C 'due':95C 'escap':102C 'execut':126C 'field':35B 'imag':2A,19B,25B,70C 'includ':93C 'inject':7A,38B,118C,132C 'input':98C 'insuffici':97C 'level':52B,113C 'make':104C 'name':10A,34B,85C 'open':64B 'output':101C 'packag':21B 'page':45B,67B,123C,133C 'paramet':86C 'plugin':4A,20B,26B,71C 'possibl':106C 'run':43B,55B 'sanit':31B,99C 'save':41B 'script':6A,37B,56B,81C,121C 'site':80C 'store':5A,77C 'subscrib':51B,112C 'subscriber-level':50B,111C 'user':129C 'version':89C 'via':8A,82C 'visitor':62B 'vulner':75C 'web':120C 'whenev':127C 'wordpress':3A,22B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Author Image WordPress plugin version 4.9.3 or earlier where subscriber-level users can exist. Sites without this plugin, or without user accounts that can set a display name, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authorimageplugin","medium","package","wordpress"],"campaign_type":null,"search_a":"'-119097':13A,16A '-2026':12A,15A 'author':1A 'cve':11A,14A 'display':9A 'imag':2A 'inject':7A 'name':10A 'plugin':4A 'script':6A 'store':5A 'via':8A 'wordpress':3A","search_b":"'account':53B 'affect':66B 'attack':47B 'author':18B,24B 'author-image-plugin':17B 'browser':59B 'display':33B 'field':35B 'imag':19B,25B 'inject':38B 'level':52B 'name':34B 'open':64B 'packag':21B 'page':45B,67B 'plugin':20B,26B 'run':43B,55B 'sanit':31B 'save':41B 'script':37B,56B 'subscrib':51B 'subscriber-level':50B 'visitor':62B 'wordpress':22B,28B","search_c":"'4.9.3':94C 'access':114C,130C 'arbitrari':119C 'attack':109C 'authent':108C 'author':69C 'cross':79C 'cross-sit':78C 'display':84C 'due':95C 'escap':102C 'execut':126C 'imag':70C 'includ':93C 'inject':118C,132C 'input':98C 'insuffici':97C 'level':113C 'make':104C 'name':85C 'output':101C 'page':123C,133C 'paramet':86C 'plugin':71C 'possibl':106C 'sanit':99C 'script':81C,121C 'site':80C 'store':77C 'subscrib':112C 'subscriber-level':111C 'user':129C 'version':89C 'via':82C 'vulner':75C 'web':120C 'whenev':127C 'wordpress':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119097","severity":null,"published_at":"2026-11-11T12:19:11+00:00","modified_at":"2026-11-11T12:19:11+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}