CVE-2026-1373: 
WordPress vulnerability analysis and mitigation

CVE-2026-1373 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Author Image plugin for WordPress. It affects all versions up to and including 1.7, caused by insufficient input sanitization and output escaping of the author_profile_picture_url parameter. Authenticated attackers with Subscriber-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) and was published on February 19, 2026 (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the plugin fails to properly sanitize user-supplied input to the author_profile_picture_url parameter and does not escape the value on output, allowing malicious script content to be stored in the database and rendered in page HTML. An attacker with at minimum Subscriber-level WordPress credentials can submit a crafted payload via this parameter; the payload is then persistently stored and executed in the browser of any user who views the affected author profile page (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, enabling session cookie theft, credential harvesting, unauthorized administrative actions, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component to the browsers of site visitors. While there is no direct availability impact, confidentiality and integrity of user sessions and site content are at risk (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Subscriber level, which lowers the risk compared to unauthenticated XSS flaws, but Subscriber accounts are commonly available on sites with open registration. There is no indication this CVE has been added to the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Easy Author Image plugin version 1.7 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain Subscriber access: Register for a subscriber account on the target WordPress site (if open registration is enabled) or use compromised credentials.
3. Craft malicious payload: Prepare a stored XSS payload, e.g., javascript:alert(document.cookie) or a more sophisticated script to exfiltrate session cookies to an attacker-controlled server.
4. Inject payload: Authenticate to the WordPress site and update the author_profile_picture_url parameter in the author profile settings with the crafted XSS payload.
5. Trigger execution: When any user (including administrators) visits a page that renders the injected author profile picture URL, the malicious script executes in their browser, potentially stealing session tokens or performing actions on their behalf (Red Hat CVE, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to profile update endpoints (e.g., wp-admin/profile.php or REST API profile endpoints) containing JavaScript or encoded script tags in the author_profile_picture_url field.
• Database: Unexpected JavaScript content (e.g., <script>, javascript:, onerror=, onload=) stored in the wp_usermeta table associated with the author_profile_picture_url meta key.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting author profile pages, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for a stored XSS; however, monitor for new or modified plugin files in the Easy Author Image plugin directory that may indicate further compromise.

WordPress site administrators should update the Easy Author Image plugin to a version beyond 1.7 if a patched release is available from the plugin's official WordPress.org repository. If no patch is yet available, disabling the plugin is the recommended interim workaround. Additionally, restricting user registration to prevent untrusted Subscriber-level accounts and implementing a Web Application Firewall (WAF) with XSS filtering rules can reduce exposure (Wordfence, Red Hat CVE).

Wordfence included CVE-2026-1373 in its weekly WordPress vulnerability report for February 16–22, 2026, as part of routine plugin vulnerability tracking. No notable individual researcher commentary or significant media coverage beyond standard vulnerability aggregation has been identified for this CVE (Wordfence).