CVE-2026-42643

The Image Widget plugin for WordPress, developed by StellarWP, suffers from a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects versions from n/a through 4.4.11 [1].

An attacker with the required privileges can inject malicious scripts into the image widget, which are then stored and executed when other users visit the affected page. Successful exploitation requires a privileged user to perform an action, such as clicking a crafted link, to trigger the script injection [1].

The impact allows a malicious actor to inject arbitrary scripts, including redirects, advertisements, and other HTML payloads, potentially compromising the security of the website and its visitors [1].

To mitigate this vulnerability, users should update the plugin to version 4.4.12 or later. Patchstack users can enable auto-updates for vulnerable plugins to ensure protection [1].