CVE-2026-1373

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1373", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-23T16:49:30.413Z", "datePublished": "2026-02-19T04:36:26.857Z", "dateUpdated": "2026-04-08T17:31:02.794Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:02.794Z"}, "affected": [{"vendor": "lawsonry", "product": "Easy Author Image", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_url' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa53088-c383-4315-9871-b4ceb83f5fdb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-author-image/tags/1.7/easy-author-image.php#L149"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2026-01-12T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T15:53:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:25:22.183459Z", "id": "CVE-2026-1373", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:25:54.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1373", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T21:25:22.183459Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:25:31.394Z"}}], "cna": {"title": "Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "lawsonry", "product": "Easy Author Image", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-12T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T15:53:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa53088-c383-4315-9871-b4ceb83f5fdb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-author-image/tags/1.7/easy-author-image.php#L149"}], "descriptions": [{"lang": "en", "value": "The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_url' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:02.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1373", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:02.794Z", "dateReserved": "2026-01-23T16:49:30.413Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:26.857Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Easy Author Image", "vendor": "lawsonry", "versions": [{"lessThanOrEqual": "1.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_url' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Easy Author Image para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'author_profile_picture_url' en todas las versiones hasta la 1.7, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y al escape de la salida. Esto permite que atacantes autenticados, con acceso de nivel Suscriptor y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1373", "lastModified": "2026-06-17T10:15:40.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1373", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:25:22.183459Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:43.717", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-author-image/tags/1.7/easy-author-image.php#L149"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa53088-c383-4315-9871-b4ceb83f5fdb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Easy Author Image", "source": "cna", "vendor": "lawsonry"}, "product": "easy_author_image", "vendor": "lawsonry"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:09:51.374153+00:00", "value": {"mitigation_remediation": ["Upgrade Easy Author Image to the latest available version (\u22651.8) which removes the unsanitized author_profile_picture_url field.", "If an upgrade is not immediately possible, delete or disable the author_profile_picture_url field in the plugin\u2019s code or in the database and replace it with a properly validated upload input that sanitizes URLs before storage.", "After applying the fix, run a security scan or manually review the profile pages to ensure no malicious scripts are stored or rendered."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via the author_profile_picture_url field"}, "threat_synthesis": {"affected_systems": "Lawsonry\u2019s Easy Author Image plugin, all releases through version 1.7, is affected. Any WordPress site that has installed this plugin in that range is vulnerable.", "description_and_impact": "The Easy Author Image plugin for WordPress stores user input from the author_profile_picture_url field without sufficient sanitization or escaping, allowing an authenticated user with Subscriber-level access or higher to place arbitrary JavaScript that will run in the browser of any visitor that opens the affected page. The vulnerability arises from the plugin\u2019s failure to filter and escape this input before rendering it on profile pages.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1\u202f%, suggesting a very low likelihood of exploitation in the wild. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires an authenticated user with at least Subscriber role, a role that is widely available on WordPress sites, which could enable widespread impact if discovered and abused."}}}}, "created": "2026-02-19T10:06:48.789919+00:00", "updated": "2026-04-15T18:15:10.842942+00:00", "vendors": ["lawsonry", "lawsonry$PRODUCT$easy_author_image", "wordpress", "wordpress$PRODUCT$wordpress"]}