The featured image URL plugin for WordPress allows authenticated users with Contributor-level access or higher to store arbitrary JavaScript code in the custom fields associated with a post’s featured image. The stored code is not properly sanitized or escaped and executes in the browser of any user who views the affected post, potentially leading to session hijacking, credential theft, or defacement of the site. This weakness is a classic Stored Cross‑Site Scripting vulnerability identified as CWE‑79 and can compromise confidentiality, integrity, and availability of the site’s web content.

The vulnerability applies to all releases of the Featured Image from URL (FIFU) plugin by marceljm up to and including version 5.2.7. A partial mitigation was introduced in version 5.2.2, but the flaw remains until at least 5.2.7. WordPress sites running any of these versions are at risk.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires authenticated access with Contributor or higher privileges; an attacker must obtain such credentials or exploit them opportunistically. Once the malicious payload is stored it will be delivered to all visitors of the impacted post.