CVE-2026-86780: WordPress Featured Image with URL XSS Flaw

CVE-2026-86780 Overview

CVE-2026-86780 is a Stored Cross-Site Scripting (XSS) vulnerability in the Featured Image with URL WordPress plugin before version 1.0.6. The plugin fails to sanitise and escape a stored image attribute value before outputting it in rendered posts. Users with a role as low as Contributor can inject malicious JavaScript that executes in the browser of any visitor viewing the affected post. Because higher-privileged users such as Editors and Administrators also render the injected content, attackers can pivot from low-privilege access to full site compromise through session theft, admin action forgery, or backend account takeover. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A Contributor-level account can plant persistent JavaScript that runs against Administrators, enabling account takeover of the WordPress site.

Affected Products

Featured Image with URL WordPress plugin versions prior to 1.0.6
WordPress sites that permit Contributor-level registration or self-service accounts
Multi-author WordPress deployments using the vulnerable plugin

Discovery Timeline

2026-09-11 - CVE-2026-86780 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-86780

Vulnerability Analysis

The Featured Image with URL plugin allows post authors to specify an external URL as a featured image instead of uploading media to the WordPress library. The plugin stores an image attribute value associated with the post and later renders that value into the generated HTML output. The rendering path does not apply output escaping such as esc_attr() or esc_url() before injecting the value into the page markup.

An attacker who holds a Contributor role can submit a crafted attribute value containing HTML or JavaScript payloads. When any user views the resulting post, the browser parses the payload as active script content instead of inert data. This grants the attacker code execution in the victim's authenticated browser session. When Editors or Administrators preview or moderate the submitted post, the payload executes with their privileges, enabling actions such as creating new administrator accounts, modifying plugin code, or exfiltrating session cookies.

Root Cause

The root cause is missing output encoding on a stored, user-controlled image attribute. WordPress provides escaping helpers including esc_attr(), esc_url(), and wp_kses() for exactly this class of data flow. The vulnerable code path writes the stored attribute directly into HTML context without invoking any of these helpers, satisfying the CWE-79 pattern.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges and user interaction from a victim who views the malicious post. The attacker submits a post that uses the plugin's featured image URL functionality with a payload embedded in the image attribute. Once the post is rendered — either in preview, moderation queue, or after publication — the stored script fires in every viewing browser. Refer to the WPScan Vulnerability Report for the disclosure details.

Detection Methods for CVE-2026-86780

Indicators of Compromise

Post revisions containing HTML event handlers such as onerror=, onload=, or <script> inside featured image URL fields.
Unexpected new Administrator accounts or user role changes created shortly after Editor or Administrator sessions viewed Contributor submissions.
Outbound requests from wp-admin sessions to attacker-controlled domains embedded in stored image attributes.

Detection Strategies

Review the wp_posts and wp_postmeta tables for image URL metadata containing characters like ", <, >, or javascript: schemes.
Inspect web server access logs for POST requests to post.php and post-new.php from Contributor accounts followed by admin session activity.
Deploy a Content Security Policy in report-only mode to surface inline script executions from the WordPress frontend.

Monitoring Recommendations

Alert on creation of new users with administrator role outside of change windows.
Monitor plugin and theme file modifications through file integrity monitoring on wp-content/.
Track authentication events for Editor and Administrator accounts that immediately follow viewing of pending Contributor posts.

How to Mitigate CVE-2026-86780

Immediate Actions Required

Update the Featured Image with URL plugin to version 1.0.6 or later on all WordPress installations.
Audit existing posts and post metadata for injected script payloads in image attribute fields and remove any that are found.
Review recently created user accounts and revoke any unauthorised Administrator or Editor accounts.

Patch Information

Upgrade the Featured Image with URL plugin to version 1.0.6 or later. The fixed version applies proper output escaping to the stored image attribute before rendering. Confirm the installed version through the WordPress plugins dashboard or the wp plugin list WP-CLI command.

Workarounds

Deactivate the Featured Image with URL plugin until the update to 1.0.6 or later is applied.
Restrict Contributor role assignments and disable open registration on sites that do not require external authors.
Enforce a strict Content Security Policy that blocks inline scripts on the WordPress frontend to reduce the impact of stored XSS.

bash

# Configuration example
wp plugin update featured-image-from-url --version=1.0.6
wp user list --role=administrator --fields=ID,user_login,user_registered