Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. This is due to the shortcode rendering path passing attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute when users interact with the injected frontend page via the 'class' shortcode attribute.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-18 | 1 | Disclosure1 |
| 2026-04-19 | 1 | Active Exploitation1 |
Some increased actor activities are shown targeting elzahlan Categories Images Plugin (CVE-2026-2505) https://vuldb.com/vuln/358194/cti
Post summary
The tweet reports that attackers are actively targeting the elzahlan Categories Images Plugin via CVE-2026-2505, but offers no PoC, exploit code, or patch information.
CVE-2026-2505 The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. T… https://www.cve.org/CVERecord?id=CVE-2026-2505
Post summary
CVE-2026-2505 identifies a stored XSS flaw in the Categories Images WordPress plugin (≤3.3.1) triggered through the z_taxonomy_image shortcode, with no PoC, exploit, or patch details provided.