External url as post Featured Image (thumbnail)
External url as post Featured Image (thumbnail) has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for External url as post Featured Image (thumbnail) has a vendor fix available, so running the current release closes it.
All of these findings were reported by WPScanTeam. External url as post Featured Image (thumbnail) is installed on roughly 80 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.
External url as post Featured Image <= 2.02 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
External url as post Featured Image (thumbnail)
Author
Puvox Software
[ ✅ 𝐒𝐄𝐂𝐔𝐑𝐄 𝐏𝐋𝐔𝐆𝐈𝐍𝐒 b𝓎 𝒫𝓊𝓋𝑜𝓍] : • Revised for security to be reliable and free of vulnerability holes. • Efficient, not to add any extra load/slowness to site. • Don’t collect private data. Plugin Description Set External-URL as post thumbnail url. (For developers: you can also use a filter-hook to programatically set/get external url as post’s thumbnail. Read more in plugin’s dashboard page) Gutenberg not supported yet. Feature: Youtube Thumbnails This plugin has an additional option You can set youtube’s thumbnails as post’s featured image automatically ( Read more in plugin’s dashboard page) . Available Options See all available options and their description on plugin’s settings page.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C