CVE-2026-122059

Name of the Vulnerable Software and Affected Versions WP ImageViewer versions prior to 3.0.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored DOM-Based Cross-Site Scripting. This occurs via the img.alt parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. For subscriber-level users to exploit this, a front-end content plugin like bbPress must be active to provide the bbp participant capability. Attackers with contributor-level access or higher can exploit this if the site allows them to submit image HTML in post content. In default installations where this is not configured, custom-level access or higher is required.

Recommendations Update WP ImageViewer to version 3.0.3 or later.