Featured Image Plugin Stored Cross-Site Scripting Vulnerability (CVE-2025-12019) — Medium Severity

Understanding the Featured Image Plugin XSS Vulnerability

The “Featured Image” plugin for WordPress, in versions up to and including 2.1, has a significant security flaw. This vulnerability, known as Stored Cross-Site Scripting (XSS), occurs because the plugin doesn’t properly clean up or “escape” certain information related to images before showing it on your website. Specifically, the “alt text” and “caption” you assign to images are affected.

This means that if someone with administrative access (or higher) to your WordPress site uploads an image and puts malicious code into its alt text or caption, that code can be saved directly into your website’s database. Later, whenever a visitor views a page where this featured image is displayed, the malicious code will automatically run in their web browser. This issue primarily impacts WordPress multi-site installations or regular installations where the unfiltered_html option has been turned off.

CVE Details

• Product Name: Featured Image plugin for WordPress
• Published Date: November 11, 2025
• Severity: Medium
• Status: Analyzed

Affected Products

This vulnerability affects the “Featured Image” plugin for WordPress. Specifically, all versions up to and including 2.1 are vulnerable. If you are using any version within this range, your website is at risk.

Current Status

As of November 11, 2025, this vulnerability has been “Analyzed.” This means the details of the flaw are understood and documented by security researchers.

Severity Level

Rated as “Medium” severity, this Stored Cross-Site Scripting vulnerability can still lead to serious consequences. While it requires an authenticated administrator to inject the malicious code, once injected, it can affect all users who visit the compromised pages. This could result in sensitive information theft, unauthorized actions being performed on behalf of the user, or defacement of the website. Because the code is “stored” on the server, it persists until removed, making it a persistent threat.

Possible Solutions

To protect your WordPress website from this vulnerability, here are the recommended steps:

1. Update the Plugin: The most crucial step is to update your “Featured Image” plugin to a version higher than 2.1 as soon as a patch becomes available from the developer. Always keep your plugins, themes, and WordPress core updated to their latest secure versions.
2. Review Image Metadata: If an update is not immediately available, carefully review all existing image alt texts and captions, especially those uploaded by administrators, for any suspicious code.
3. Implement Input Validation and Output Escaping: For developers, the core issue lies in insufficient input sanitization and output escaping. Future versions of the plugin should use WordPress’s built-in functions like esc_attr() for attributes (like image alt text) and esc_html() for HTML content (like captions) to prevent similar injection attacks.
4. Consider Disabling: If no immediate fix or update is available, consider temporarily deactivating the “Featured Image” plugin until a secure version is released. Assess the impact this might have on your site’s functionality before doing so.

References

https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md

https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L26

https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L35

https://plugins.trac.wordpress.org/browser/featured-image/tags/2.1/featured-image.php#L65

Featured Image

https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=cve

https://github.com/zast-ai/vulnerability-reports/blob/main/wordpress/plugin/featured-image/stored-xss.md