cleantalk
Vulnerabilities and Security Researches

Easy Author Image, CVE-2026-1373

CVE, Research URL

CVE-2026-1373

Home page URL

Security reports for Easy Author Image

Application

Easy Author Image

Published on
Feb 19, 2026
Research Description
The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_url' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
max 1.7.
Status
vulnerable
Previous vulnerability researches
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder (CVE-2024-50477) , Oct 29, 2024
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder (CVE-2024-50528) , Nov 03, 2024
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder (CVE-2024-50527) , Nov 03, 2024
New vulnerability
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder (CVE-2026-0996) , Apr 15, 2026
Export any WordPress data to XML/CSV (CVE-2026-1582) , Apr 15, 2026
Shield Security – Smart Bot Blocking & Intrusion Prevention Security (CVE-2026-0561) , Apr 15, 2026
Shield Security – Smart Bot Blocking & Intrusion Prevention Security (CVE-2026-0722) , Apr 15, 2026
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX (CVE-2026-1273) , Apr 15, 2026