Featured Image Vulnerabilities

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 2.1

Fixed in:

2.2

Disclosed:

Jun 25, 2026

CVE-2026-57431 on NVD →

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbi...

CVSS:

4.4

Affected:

up to 2.1

Fixed in:

2.2

Disclosed:

Nov 10, 2025

CVE-2025-12019 on NVD →