404 Image Redirection (Replace Broken Images)

404 Image Redirection (Replace Broken Images) has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for 404 Image Redirection (Replace Broken Images) has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nguyen Xuan Chien. 404 Image Redirection (Replace Broken Images) is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all 404 Image Redirection (Replace Broken Images) vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2025-32266

404 Image Redirection (Replace Broken Images) <= 1.4 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
404 Image Redirection (Replace Broken Images) banner
Latestv2.0.0

404 Image Redirection (Replace Broken Images)

wp-buy

Author

wp-buy

3.5(2)
70/100
Last Updated
2026-05-09 (4mo ago)
Active Installs
500+
Downloads
10,514
Requires WP
5.0+
Requires PHP
7.2+
Tested up to
WP 6.9.7
Created
2021-12-08 (5y ago)

404 Image Redirection (Replace Broken Images) prevents broken image icons from appearing on your WordPress site. When a visitor requests an image that no longer exists, the plugin either serves a default replacement image or removes the broken image from the page entirely — your choice. Why this plugin? Broken images hurt your site: * They damage user experience — visitors lose trust instantly * They hurt your SEO — search engines penalize 404 errors * They look unprofessional — especially on product and content pages Key Features Replace broken images with a default image of your choice Hide broken images entirely — JavaScript removes them from the DOM along with their links and captions Custom redirection rules — map specific broken image URLs to specific replacement images Server-level performance on Apache — uses a small .htaccess rule, zero PHP overhead per request PHP fallback for Nginx and LiteSpeed — works on any host, even if .htaccess is unavailable Clean uninstall — removes only what the plugin added, never touches WordPress or other plugins’ rules Master kill switch — when you toggle the plugin off, it truly stops working How it works On Apache servers, the plugin writes a small rewrite rule to your wp-content/.htaccess file. When a visitor requests a missing image, your server serves the replacement image instead of returning a 404. This is fast (no PHP execution per image) and SEO-friendly (the response is a real 200 OK with a real image). On Nginx, LiteSpeed, or hosts with a non-writable .htaccess, the plugin automatically falls back to a PHP-based handler that does the same job via WordPress’s template_redirect hook. Two display modes 1. Replace mode (default): Show your chosen default image whenever a broken image is requested. Best for visual consistency. 2. Hide mode: Remove broken images from the page entirely, along with their parent link and surrounding <figure> or caption wrapper. Best for clean layouts where missing images should leave no trace. Privacy This plugin does not collect, store, or transmit any data outside your WordPress installation. No tracking, no analytics, no external requests.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C