Category Featured Images
Category Featured Images has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Category Featured Images has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Muhammad Yudha - DJ. Category Featured Images is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.1.42.
CVE-2025-58655Category Featured Images <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Category Featured Images
Author
Mat
This plugin allows to set a featured image for each category. Posts without a featured image set will show the category’s featured image instead. Featured images usually are placed by the theme in the single post page, in the latest posts page, etc. But can also be shown using the shortcode [cfi_featured_image] or the PHP function cfi_featured_image(). To get the featured image URL I added the function cfi_featured_image_url(). Shortcode/PHP function optional arguments: ‘size’: ‘thumbnail’, ‘medium’, ‘large’, ‘full’ ‘class’: class of the image tag ‘alt’: alternative text of the image tag ‘title’: title of the image tag ‘cat_id’: select a specific category id Shortcode example: [cfi_featured_image size="large" title="This is a test..." class="my-image" alt="My image"] Function example 1: cfi_featured_image( array( 'size' => 'large', 'title' => 'This is a test...', 'class' => 'my-image', 'alt' => 'My image' ) ); Function example 2: cfi_featured_image_url( array( 'size' => 'large' ) ); Notes: If a post has more than a category with a featured image the first available is loaded If a category hasn’t a featured image but it has a parent category with a featured image the parent one is loaded
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C