Alttext Ai Vulnerabilities

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenti...

CVSS:

4.3

(Wordfence)

Affected:

up to 1.10.41

Fixed in:

1.10.42

Disclosed:

Oct 2, 2026

CVE-2026-91108 on NVD →

[en] Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.10.15.

Affected:

up to 1.10.15

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-25348 on NVD →

The Download Alt Text AI plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.10.15. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 1.10.15

Fixed in:

1.10.18

Disclosed:

Feb 14, 2026

CVE-2026-25348 on NVD →

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in all versions up to, and including, 1.9.93. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVSS:

4.3

(Wordfence)

Affected:

up to 1.9.93

Fixed in:

1.9.94

Disclosed:

Apr 22, 2025

CVE-2025-46232 on NVD →

[en] Missing Authorization vulnerability in alttextai Download Alt Text AI allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Download Alt Text AI: from n/a through 1.9.93.

Affected:

up to 1.9.94

Fixed in:

1.9.94

Disclosed:

Apr 22, 2025

CVE-2025-46232 on NVD →

[en] The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_post_id’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Affected:

up to 1.5.0

Fixed in:

1.5.0

Disclosed:

May 15, 2024

CVE-2024-4847 on NVD →

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_post_id’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVSS:

8.8

(Wordfence)

Affected:

up to 1.4.9

Fixed in:

1.5.0

Disclosed:

May 14, 2024

CVE-2024-4847 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This issue affects Download Alt Text AI: from n/a through 1.3.4.

Affected:

up to 1.3.5

Fixed in:

1.3.5

Disclosed:

May 6, 2024

CVE-2024-34366 on NVD →

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVSS:

4.4

(Wordfence)

Affected:

up to 1.3.4

Fixed in:

1.3.5

Disclosed:

May 3, 2024

CVE-2024-34366 on NVD →