{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4852", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-25T15:00:41.185Z", "datePublished": "2026-04-20T20:26:53.256Z", "dateUpdated": "2026-04-20T20:26:53.256Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-20T20:26:53.256Z"}, "affected": [{"vendor": "webzunft", "product": "Image Source Control Lite \u2013 Show Image Credits and Captions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Image Source Control Lite \u2013 Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image Source' attachment field in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Image Source Control Lite \u2013 Show Image Credits and Captions <= 3.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/db0222e2-5a50-43f4-8620-12b97c712dec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/image-source-control-isc/tags/3.8.0/public/views/global-list.php#L37"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Vilaysone CHANTHAVONG"}], "timeline": [{"time": "2026-02-02T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-26T06:44:09.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-20T07:57:34.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Image Source Control Lite \u2013 Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image Source' attachment field in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-4852", "lastModified": "2026-04-20T21:16:36.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-20T21:16:36.560", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/image-source-control-isc/tags/3.8.0/public/views/global-list.php#L37"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/db0222e2-5a50-43f4-8620-12b97c712dec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:59:26.938565+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to the latest release (version 3.9.2 or later).", "If an upgrade cannot be performed immediately, revoke or reduce Author privileges for affected users and consider disabling the Image Source field or the whole plugin until a patch is applied.", "Implement a Content Security Policy that restricts inline scripts and disallows execution of JavaScript from user input to provide a temporary mitigation."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Image Source Control Lite \u2013 Show Image Credits and Captions plugin installed, versions up to and including 3.9.1. The vulnerability is present in all legacy releases of the plugin and is not limited to a single minor version.", "description_and_impact": "The plugin permits arbitrary web scripts to be stored in the Image Source field. An attacker with Author level or higher can inject malicious code that will be executed in the context of any user viewing the affected page, potentially allowing credential theft, defacement or further code execution. The vulnerability stems from insufficient input sanitization and output escaping, classified as CWE\u201179. The CVSS score of 6.4 indicates a moderate severity level.", "risk_and_exploitability": "Exploitation requires an authenticated session with Author or higher privileges and access to the Image Source editing interface. Once the script is stored, it automatically triggers for each visitor who loads pages that reference the edited image, making it a classic stored XSS scenario. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the moderate CVSS score implies that it is a credible threat especially on sites with high traffic and without additional mitigations such as a strict Content Security Policy."}}}}, "created": "2026-04-21T00:00:13.352331+00:00", "updated": "2026-04-21T00:00:13.352352+00:00", "vendors": []}