CVE-2026-92767

Name of the Vulnerable Software and Affected Versions Twenty20 Image Before-After versions prior to 2.0.6

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the offset shortcode attribute, which execute when a user visits the affected page.

Recommendations Update the plugin to version 2.0.6 or later.