The Image Alt Text Manager plugin for WordPress allows an author‑level or higher authenticated user to store malicious scripts in post titles. The plugin builds image alt and title attributes through a DOM parser without sufficient input sanitization or output escaping, leading to stored XSS. This flaw holds the CWE‑79 classification. An attacker can inject JavaScript that runs whenever any visitor loads a page containing the affected post, potentially leading to cookie theft, session hijacking, defacement, or other client‑side compromise.

WordPress sites that have the Image Alt Text Manager plugin versions up to and including 1.8.2 installed. All such sites are vulnerable regardless of the core WordPress version or other plugins. Any user with Author or higher role on the site can exploit the flaw.

With a CVSS score of 6.4, the vulnerability is of moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is authenticated; an attacker must log in with Author privileges or higher to inject a malicious title. Once stored, the payload is executed immediately for every user who views the affected page, making the impact immediate and site‑wide. Sites with many authors and without mitigation measures face a significant risk of exploitation.