CVE-2026-3722 Overview
CVE-2026-3722 is a Stored Cross-Site Scripting (XSS) vulnerability in the Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) plugin for WordPress. The flaw affects all versions up to and including 4.9. It stems from insufficient input sanitization and output escaping in attachment metadata handling. Authenticated attackers with Author-level access or higher can inject arbitrary JavaScript into pages. Injected scripts execute in the browser context of any user who views an affected page. The weakness is tracked under CWE-79.
Critical Impact
Authenticated Author-level users can persist malicious scripts through attachment metadata, leading to session theft, administrative account takeover, and arbitrary actions in the browser context of site visitors and administrators.
Affected Products
- Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) plugin for WordPress
- All versions up to and including 4.9
- WordPress sites permitting Author-level (or higher) user registration with the plugin active
Discovery Timeline
- 2026-06-02 - CVE-2026-3722 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-3722
Vulnerability Analysis
The plugin automatically populates WordPress attachment metadata (alt text, image title, caption, description) derived from filenames and user-supplied values. The vulnerable code paths in admin/columns-media-library.php and admin/do.php render attachment metadata back to administrative and front-end pages without applying adequate escaping functions such as esc_html(), esc_attr(), or wp_kses().
An authenticated attacker with Author-level privileges can upload media or modify attachment metadata to include JavaScript payloads. Because the malicious content is stored in the WordPress database, every request that renders the affected attachment metadata executes the script in the requesting user's browser. The attack scope is Changed (S:C), meaning the impact extends beyond the vulnerable component to other site visitors and administrators.
Root Cause
The root cause is missing input sanitization on write and missing output escaping on render. Attachment metadata strings are accepted from authenticated users and stored without filtering HTML or JavaScript. The plugin then echoes those strings into HTML contexts without contextual escaping, allowing <script> tags and event handlers to execute.
Attack Vector
Exploitation requires authenticated access at the Author role or above, which is common on multi-author WordPress sites, news outlets, and membership platforms. The attacker uploads or edits an image attachment and injects a JavaScript payload into a metadata field such as alt text, title, or caption. When an administrator opens the Media Library list view or any front-end page rendering that attachment, the payload executes. Successful exploitation can hijack administrator sessions, create new privileged users, plant backdoors in themes or plugins, or redirect visitors to malicious infrastructure. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review (do.php) for the specific lines involved.
Detection Methods for CVE-2026-3722
Indicators of Compromise
- Attachment metadata fields (alt text, title, caption, description) in wp_posts and wp_postmeta containing <script>, onerror=, onload=, or javascript: strings.
- New WordPress administrator accounts or unexpected role changes following Author-level activity.
- Outbound browser requests from administrator sessions to unfamiliar domains after viewing Media Library pages.
- Modified theme or plugin files with timestamps correlating to Author-account activity.
Detection Strategies
- Run a database query against wp_postmeta and wp_posts to surface attachment metadata containing HTML tags or JavaScript event handlers.
- Audit Author-role accounts for recent media uploads and metadata edits via the WordPress activity log.
- Inspect HTTP response bodies of /wp-admin/upload.php and rendered pages for inline scripts originating from attachment fields.
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record media uploads, metadata changes, and user role modifications.
- Monitor web application firewall (WAF) logs for POST requests to admin-ajax.php and post.php containing script tags in attachment parameters.
- Alert on creation of new administrator users or modifications to wp-config.php, functions.php, and plugin source files.
How to Mitigate CVE-2026-3722
Immediate Actions Required
- Update the Auto Image Attributes From Filename With Bulk Updater plugin to a version later than 4.9 once the vendor publishes a patched release.
- Review and sanitize existing attachment metadata for stored script payloads across all media items.
- Restrict Author-level and higher accounts to trusted users and enforce strong authentication including multi-factor authentication.
- Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected.
Patch Information
At the time of NVD publication on 2026-06-02, the plugin was vulnerable in all versions up to and including 4.9. Site operators should monitor the plugin repository and the Wordfence advisory for a fixed release and apply it immediately upon availability.
Workarounds
- Deactivate and remove the plugin until a patched version is released.
- Demote untrusted Author and Editor accounts to Contributor or Subscriber to remove media upload privileges.
- Deploy a WordPress-aware WAF rule set to filter script tags and JavaScript event handlers from attachment metadata fields.
- Apply Content Security Policy (CSP) headers that disallow inline scripts to reduce the impact of stored XSS execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
