{"id":"CVE-2026-123476","kind":"vulnerability","aliases":["CVE-2026-123476"],"related":[],"title":"Featured Image from URL WordPress plugin: stored XSS through 6.1.4","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4.","summary":"The Featured Image from URL WordPress plugin (by fifu.app) lets stored cross-site scripting in through 6.1.4. An attacker who can save content can run script in other users' browsers when they view the page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"featured-image-from-url","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["featured-image-from-url","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Featured Image from URL (`featured-image-from-url`) in the WordPress plugins screen or `wp plugin get featured-image-from-url --field=version`\n- Confirm whether the installed version is 6.1.4 or earlier","fix":"- Featured Image from URL: fixed version unknown from the sources; the affected range is up to and including `6.1.4`","status":"open","published_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","triaged_at":"2026-11-09T11:26:33+00:00","updated_at":"2026-11-09T11:26:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:33Z","model":"claude-haiku-5-5","output":{"fix":"- Featured Image from URL: fixed version unknown from the sources; the affected range is up to and including `6.1.4`","reach":"internet","title":"Featured Image from URL WordPress plugin: stored XSS through 6.1.4","impact":"medium","summary":"The Featured Image from URL WordPress plugin (by fifu.app) lets stored cross-site scripting in through 6.1.4. An attacker who can save content can run script in other users' browsers when they view the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","featured-image-from-url"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other visitors' browsers on the site","analyst_note":"Find the fixed version and the required privilege level for the stored XSS in the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed version of Featured Image from URL (`featured-image-from-url`) in the WordPress plugins screen or `wp plugin get featured-image-from-url --field=version`\n- Confirm whether the installed version is 6.1.4 or earlier","plain_action":"","product_name":"featured-image-from-url","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Featured Image from URL WordPress plugin at version 6.1.4 or earlier. The sources do not say which user roles can inject the stored script, so treat any site where untrusted users can submit content as exposed. Sites that do not run this plugin are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4551,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123476':13A,16A '-2026':12A,15A '6.1.4':10A,46B,101C 'affect':93C 'allow':89C 'attack':48B 'browser':59B 'content':52B 'cross':41B,74C 'cross-sit':40B,73C 'cve':11A,14A 'featur':1A,23B,30B,80C,85C,94C 'featured':18A 'featured-image-from-url':17A,22B,84C 'fifu.app':37B,79C 'from':20A 'generat':72C 'imag':2A,24B,31B,81C,86C,95C 'image':19A 'improp':65C 'input':68C 'issu':92C 'let':38B 'n/a':99C 'neutral':66C 'packag':27B 'page':64B,71C 'plugin':6A,35B 'run':54B 'save':51B 'script':43B,55B,76C 'site':42B,75C 'store':7A,39B,90C 'url':4A,21A,26B,33B,83C,88C,97C 'user':58B 'view':62B 'vulner':77C 'web':70C 'wordpress':5A,28B,34B 'xss':8A 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Featured Image from URL WordPress plugin at version 6.1.4 or earlier. The sources do not say which user roles can inject the stored script, so treat any site where untrusted users can submit content as exposed. Sites that do not run this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["featuredimagefromurl"],"ptokens":["featured","from","image","url"],"labels":["featuredimagefromurl","high","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-123476':13A,16A '-2026':12A,15A '6.1.4':10A 'cve':11A,14A 'featur':1A 'featured':18A 'featured-image-from-url':17A 'from':20A 'imag':2A 'image':19A 'plugin':6A 'store':7A 'url':4A,21A 'wordpress':5A 'xss':8A","search_b":"'6.1.4':46B 'attack':48B 'browser':59B 'content':52B 'cross':41B 'cross-sit':40B 'featur':23B,30B 'featured-image-from-url':22B 'fifu.app':37B 'imag':24B,31B 'let':38B 'packag':27B 'page':64B 'plugin':35B 'run':54B 'save':51B 'script':43B,55B 'site':42B 'store':39B 'url':26B,33B 'user':58B 'view':62B 'wordpress':28B,34B","search_c":"'6.1.4':101C 'affect':93C 'allow':89C 'cross':74C 'cross-sit':73C 'featur':80C,85C,94C 'featured-image-from-url':84C 'fifu.app':79C 'generat':72C 'imag':81C,86C,95C 'improp':65C 'input':68C 'issu':92C 'n/a':99C 'neutral':66C 'page':71C 'script':76C 'site':75C 'store':90C 'url':83C,88C,97C 'vulner':77C 'web':70C 'xss.this':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123476","severity":null,"published_at":"2026-11-09T11:17:23+00:00","modified_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:04+00:00","fetched_at":"2026-11-09T11:26:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}