Featured Image

Featured Image has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for Featured Image has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Featured Image is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSMedium

5.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Featured Image vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-57431

Featured Image <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2026-06-25 00:00	Featured Image <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting Featured Image <= 2.1	`CVE-2026-57431`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-11-10 15:23	Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting Featured Image <= 2.1	`CVE-2025-12019`	4.4 Medium	ZAST.AI	Yes

Showing 1–2 of 2 reports

Latestv2.2

Featured Image

Author

Mervin Praison

4.4(8)

88/100

Last Updated

2025-11-08 (10mo ago)

Active Installs

1,000+

Downloads

69,313

Requires WP

3.0+

Requires PHP

Tested up to

WP 6.8.8

Created

2012-03-19 (15y ago)

Add featured image to any part of the website, on each individual post/page. Very Easy to Implement. Provides you with a featured image shortcode [ featured-img ] , code and Featured Image widget. Paste the Code or the Shortcode on any part of the website. Very Easy to implement. Simple Shortcode Available Easy code Implementation inside loop and outside loop. Widge Avaliable Featured Image Caption WordPress Featured Image Documentation By Mervin Praison SEO Manager Version history version 2.2 Security: Fixed Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-12019) Fixed: Added missing global $post in caption function Improved: Enhanced security with proper output escaping version 2.1 global $post fix Version 2.0 Added Featured Image Caption Added Alt Text for images Fixed Bugs Version 1.0 Initial release version.

View on WordPress.org