Authenticated (Author) Stored XSS in “Auto Image Attributes From Filename With Bulk Updater” (≤ 4.9) — What WordPress Site Owners Need to Know and Do Now

Résumé

• Vulnerability: Authenticated stored Cross‑Site Scripting (XSS)
• Affected plugin: Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO)
• Vulnerable versions: ≤ 4.9
• Patched in: 4.9.1
• CVE: CVE-2026-3722
• Privilège requis : Auteur (authentifié)
• CVSS (public reports): 5.9 (medium; impact varies by site)
• Immediate high-level action: Update the plugin to 4.9.1 or later. If you cannot update immediately, apply mitigations (restrict uploads, disable plugin, or block exploit patterns).

Written from the perspective of a Hong Kong security consultant: pragmatic, direct and focused on what site owners need to do now. This advisory helps owners, developers and hosts understand the risk, detect indicators, and implement short‑term mitigations and long‑term fixes.

Pourquoi cela importe (langage simple)

This vulnerability allows an authenticated user with Author privileges (or higher) to store malicious JavaScript inside image metadata such as alt text or title. When those attributes are rendered without proper escaping in the admin or public pages, the stored script runs in the viewer’s browser.

Conséquences pratiques :

• An attacker with Author access can plant a persistent script that executes whenever specific admin pages or public pages are viewed.
• Scripts can steal cookies, authentication tokens, perform actions as the victim, inject drive‑by malware, deface pages or create backdoors.
• Low‑privilege injection can cascade: if higher‑privilege users view the infected content, attackers may escalate further.

Technical overview — how the vulnerability works

This is a stored XSS issue focused on image metadata handling. Typical plugin behaviour:

• Read filenames or user input to auto‑generate alt/title attributes for media images.
• Provide a bulk updater that writes generated values into postmeta (e.g. _wp_attachment_image_alt) or attachment post fields (titre_du_poste, extrait_post, contenu_du_post).
• If input is not sanitized prior to storage and not escaped on output, HTML/JS can be embedded and later executed when values are rendered.

Key characteristics of this report:

• Privilege: Author or greater can inject payload.
• Type: Stored XSS — malicious string is saved to the database and executes later.
• Attack vector: Uploading images or updating image alt/title values via the plugin’s features (bulk update from filename) using crafted input containing HTML/JS.
• Trigger: Viewing a page or admin interface that renders the malicious attribute without escaping.

Because it is stored, injected content can persist until found and removed — a durable foothold for attackers.

Scénarios d'attaque réalistes

1. Malicious Author plants persistent JS in alt/title:

   An Author uploads an image named: promo">.jpg. The plugin uses the filename to set alt/title and writes it into the DB without sanitizing. When an admin or editor previews the gallery in the admin or the theme prints the alt/title unescaped, the script executes.

2. Escalade de privilèges ciblée :

   The script exfiltrates an admin nonce or cookie to an attacker server. The attacker uses those tokens to perform privileged actions.

3. Mass seeding:

   A compromised Author account seeds many images across a site; public visitors trigger payloads and are redirected or served unwanted content.

Qui est à risque ?

• Sites running the vulnerable plugin version (≤ 4.9).
• Sites that permit user accounts with Author or similar privileges. Many multi‑author blogs and membership sites allow these roles.
• Sites or themes that render image alt/title values into HTML without proper escaping or that insert them into contexts (data attributes, inline HTML) that are vulnerable.

Detection — how to find signs of compromise or vulnerable entries

Before changing anything, take a full backup (files and database). Then investigate using these techniques.

1. Quick database search for suspicious characters in attachment metadata

SELECT post_id, meta_value
FROM wp_postmeta
WHERE meta_key = '_wp_attachment_image_alt'
  AND (meta_value LIKE '%

SELECT ID, post_title, post_excerpt
FROM wp_posts
WHERE post_type = 'attachment'
  AND (post_title LIKE '%

wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key = '_wp_attachment_image_alt' AND meta_value REGEXP '<(script|img|svg|iframe|object)|on(error|load|mouseover)|javascript:';"

wp media list --format=csv | grep -E '<|>|script|onerror|onload|javascript:'

wp db query "UPDATE wp_postmeta SET meta_value = REPLACE(REPLACE(meta_value, '<', ''), '>', '') WHERE meta_key = '_wp_attachment_image_alt' AND (meta_value LIKE '%<%' OR meta_value LIKE '%script%');"

 'attachment',
  'posts_per_page' => -1,
]);

foreach ($attachments as $att) {
  $alt = get_post_meta($att->ID, '_wp_attachment_image_alt', true);
  $clean = wp_strip_all_tags($alt);         // remove tags
  $clean = sanitize_text_field($clean);    // clean further
  if ($clean !== $alt) {
    update_post_meta($att->ID, '_wp_attachment_image_alt', $clean);
  }
}
?>

post_title);
wp_update_post(['ID' => $att->ID, 'post_title' => sanitize_text_field($post_title)]);
?>

/(<\s*script\b|javascript:|on(error|load|mouseover|focus|click)\s*=|<\s*svg|<\s*iframe\b|<\s*object\b)/i