CVE-2026-119097

Name of the Vulnerable Software and Affected Versions Author Image versions prior to 4.9.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts via the display name parameter. These scripts execute whenever a user accesses a page where the injection occurred.

Recommendations Update to version 4.9.4 or later. Avoid using the display name parameter until the update is applied.