Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute
Description
The Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment metadata in all versions up to, and including, 4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=4.9What Changed in the Fix
Changes introduced in v4.9.1
Source Code
WordPress.org SVN# Exploitation Research Plan: CVE-2026-3722 ## 1. Vulnerability Summary The **Auto Image Attributes From Filename With Bulk Updater** plugin for WordPress (versions <= 4.9) is vulnerable to **Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin registers custom columns i…
Show full research plan
Exploitation Research Plan: CVE-2026-3722
1. Vulnerability Summary
The Auto Image Attributes From Filename With Bulk Updater plugin for WordPress (versions <= 4.9) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin registers custom columns in the WordPress Media Library to display image attributes (Title, Alt Text, Caption, and Description) but fails to sanitize or escape the metadata before echoing it to the screen.
An authenticated attacker with Author level permissions or higher can modify the metadata of an image attachment (which they have permission to do by default) to include a malicious script. When an administrator views the Media Library in "List View," the script executes in their browser context.
2. Attack Vector Analysis
- Entry Point: Standard WordPress Media Metadata update (e.g.,
wp_ajax_save-attachment) or via the plugin's automatic processing of filenames. - Sink:
iaff_manage_media_custom_column_add_data()inadmin/columns-media-library.php. - Vulnerable Parameters:
- Attachment
post_title(Title) - Attachment
_wp_attachment_image_altmeta (Alternative Text) - Attachment
post_excerpt(Caption) - Attachment
post_content(Description)
- Attachment
- Authentication: Author-level access is required to upload and edit media.
- Preconditions: The plugin must be active, and the victim (Admin) must view the Media Library in List View (
upload.php?mode=list).
3. Code Flow
- Metadata Storage: An Author updates an image's metadata. This is typically done via the
wp-admin/admin-ajax.phpendpoint using thesave-attachmentaction. - Column Registration: The plugin uses
add_filter( 'manage_media_columns', 'iaff_manage_media_columns_add_columns' )to add columns namediaff_image_title,iaff_image_alt,iaff_image_caption, andiaff_image_description. - Rendering Sink: When the Media Library list is rendered, WordPress calls the hook
manage_media_custom_column, which the plugin handles viaiaff_manage_media_custom_column_add_data( $column_name, $id ). - Execution: Inside
admin/columns-media-library.php:
The raw meta value iscase 'iaff_image_alt': $iaff_image_alt = get_post_meta( $id, '_wp_attachment_image_alt', true ); echo ( $iaff_image_alt !== false ) ? $iaff_image_alt : ''; // SINK: No escaping break;echoed withoutesc_html()oresc_attr().
4. Nonce Acquisition Strategy
While the primary exploit vector involves standard WordPress media editing (which uses standard WordPress nonces), if an attacker wanted to use the plugin's Bulk Updater feature (iaff_rename_old_image), they would need the iaff_rename_old_image_nonce.
- Access Level: The settings page containing the nonce is restricted to users with
manage_options(Admins). - Strategy for Agent:
- Navigate to the plugin settings page:
wp-admin/options-general.php?page=image-attributes-from-filename. - Use
browser_evalto extract the nonce from the localized script variable (likely found in the source as part of the AJAX configuration). - Note: For a standard Stored XSS PoC starting from an Author account, we do not need the plugin's specific nonce, as we can use the default WordPress AJAX hooks to set the metadata.
- Navigate to the plugin settings page:
5. Exploitation Strategy
Step 1: Upload and Malicious Metadata Injection (Author Context)
- Log in as an Author.
- Upload a simple image file.
- Capture the
attachment_idfrom the upload response. - Send an AJAX request to update the "Alternative Text" (or Title/Caption) of the image with an XSS payload.
HTTP Request (Author):
- URL:
http://localhost:8888/wp-admin/admin-ajax.php - Method:
POST - Content-Type:
application/x-www-form-urlencoded - Parameters:
action:save-attachmentid:[ATTACHMENT_ID]nonce:[NONCE_FROM_MEDIA_PAGE]changes[alt]:"><img src=x onerror=alert(document.domain)>
Step 2: Triggering the XSS (Admin Context)
- Log in as an Administrator.
- Navigate to the Media Library list view.
- Observe the payload firing.
HTTP Request (Admin):
- URL:
http://localhost:8888/wp-admin/upload.php?mode=list - Method:
GET
6. Test Data Setup
- Plugin: Ensure
auto-image-attributes-from-filename-with-bulk-updaterversion 4.9 is installed and activated. - User: Create a user with the Author role.
- Media: Ensure at least one image is uploaded by the Author.
- View State: The exploit requires "List View". If the library is in "Grid View", the custom columns are not rendered.
7. Expected Results
- When the Admin visits
upload.php?mode=list, the HTML source will contain the unescaped payload:<td class="iaff_image_alt column-iaff_image_alt" data-colname="Alternative Text">"><img src=x onerror=alert(document.domain)></td> - A JavaScript alert box will appear showing the document domain.
8. Verification Steps
After performing the HTTP requests:
- Verify Metadata: Use WP-CLI to check the stored meta value.
wp post meta get [ATTACHMENT_ID] _wp_attachment_image_alt - Verify Admin View: Search for the payload string in the HTML response of the Media Library page using the agent's
http_requesttool.
9. Alternative Approaches
- Filename Vector: Attempt to upload a file named
<img src=x onerror=alert(1)>.png. If the plugin'siaff_auto_image_attributesfunction processes this filename on upload without sanitization, it will automatically populate the attributes with the payload. - Bulk Updater Vector: If the agent can obtain the
iaff_rename_old_image_nonce, it can triggerwp_ajax_iaff_rename_old_imageto force the plugin to re-process existing images with malicious filenames into the vulnerable metadata fields.
Summary
The Auto Image Attributes From Filename With Bulk Updater plugin (versions <= 4.9) is vulnerable to Stored Cross-Site Scripting due to insufficient output escaping in the Media Library list view. Authenticated attackers with Author-level access can inject malicious scripts into image metadata fields (Title, Alt Text, Caption, or Description), which then execute in the context of any user (such as an administrator) viewing the Media Library's list mode.
Vulnerable Code
/* admin/columns-media-library.php line 52 */ switch( $column_name ) { case 'iaff_image_title': echo $image->post_title; break; case 'iaff_image_alt': $iaff_image_alt = get_post_meta( $id, '_wp_attachment_image_alt', true ); echo ( $iaff_image_alt !== false ) ? $iaff_image_alt : ''; break; case 'iaff_image_caption': echo $image->post_excerpt; break; case 'iaff_image_description': echo $image->post_content; break; }
Security Fix
@@ -775,7 +775,7 @@ if ( ! empty( $available_tags ) ) : ?> - <p><?php _e( 'Available tags:' ); ?></p> + <p><?php _e( 'Available tags:', 'auto-image-attributes-from-filename-with-bulk-updater' ); ?></p> <p><?php _e( 'The following tags when used in a custom attribute will be replaced with their corresponding value.', 'auto-image-attributes-from-filename-with-bulk-updater' ); ?></p> <ul class="iaff-available-custom-attribute-tags" role="list"> <?php @@ -1169,6 +1169,6 @@ echo '<p class="iaff-description">' . - sprintf( __( 'Note: Requires Image Attributes Pro %s or newer to manage these options. <a href="%s" target="_blank">Read more.</a>', 'auto-image-attributes-from-filename-with-bulk-updater' ), $version, 'https://imageattributespro.com/backwards-compatibility/?utm_source=iaff-basic&utm_medium=bulk-updater-settings-tab' ) . + sprintf( esc_html__( 'Note: Requires Image Attributes Pro %1$1s or newer to manage these options. <a href="%2$2s" target="_blank">Read more.</a>', 'auto-image-attributes-from-filename-with-bulk-updater' ), esc_html( $version ), 'https://imageattributespro.com/backwards-compatibility/?utm_source=iaff-basic&utm_medium=bulk-updater-settings-tab' ) . '</p>'; } \ No newline at end of file @@ -36,7 +36,7 @@ * @since 1.0 */ function iaff_load_plugin_textdomain() { - load_plugin_textdomain( 'auto-image-attributes-from-filename-with-bulk-updater', FALSE, IAFF_IMAGE_ATTRIBUTES_FROM_FILENAME_DIR . '/languages/' ); + load_plugin_textdomain( 'auto-image-attributes-from-filename-with-bulk-updater', false, IAFF_IMAGE_ATTRIBUTES_FROM_FILENAME_DIR . '/languages/' ); } add_action( 'plugins_loaded', 'iaff_load_plugin_textdomain' ); @@ -47,20 +47,21 @@ switch( $column_name ) { case 'iaff_image_title': - echo $image->post_title; + echo esc_html( $image->post_title ); break; case 'iaff_image_alt': $iaff_image_alt = get_post_meta( $id, '_wp_attachment_image_alt', true ); - echo ( $iaff_image_alt !== false ) ? $iaff_image_alt : ''; + $iaff_image_alt = ( $iaff_image_alt !== false ) ? $iaff_image_alt : ''; + echo esc_html( $iaff_image_alt ); break; case 'iaff_image_caption': - echo $image->post_excerpt; + echo esc_html( $image->post_excerpt ); break; case 'iaff_image_description': - echo $image->post_content; + echo esc_html( $image->post_content ); break; } } \ No newline at end of file @@ -735,6 +735,8 @@ 'error' => __( 'Image object was not provided.', 'auto-image-attributes-from-filename-with-bulk-updater' ) ]; } + + $text = sanitize_text_field( $text ); // Get Settings $settings = iaff_get_settings();
Exploit Outline
To exploit this vulnerability, an attacker with at least Author-level privileges first uploads an image to the WordPress Media Library. The attacker then updates the image's metadata (such as the 'Alternative Text' or 'Title') using the standard WordPress `wp_ajax_save-attachment` AJAX action, injecting a malicious JavaScript payload (e.g., `<img src=x onerror=alert(1)>`). Alternatively, the attacker can upload a file with the payload in its filename, which the plugin may automatically process into metadata fields. To trigger the XSS, an administrator must navigate to the Media Library in 'List View' (`upload.php?mode=list`). In this view, the plugin renders its custom columns (Title, Alt Text, etc.) by echoing the stored metadata directly to the page without escaping, causing the payload to execute in the administrator's browser.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.