CVE-2025-7400

MediumCVSS 6.4

Published: 07/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Featured Image from URL (FIFU) plugin for WordPress up to version 5.2.7 is vulnerable to Stored Cross-Site Scripting (XSS) via a post's Featured Image custom fields due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.

Risk Assessment

The risk includes execution of malicious scripts in visitors' browsers, potentially leading to data theft, session hijacking, or malware distribution.

Recommendation

Update the FIFU plugin to the latest version that fully fixes the vulnerability.

Other vulnerabilities in Featured Image from URL (FIFU)

CVE-2025-9984Medium
The Featured Image from URL (FIFU) plugin for WordPress up to version 5.2.7 lacks a capability check on the fifu_api_debug_posts() function, allowing unauthenticated attackers to read private and password-protected posts.

Original NVD description (English source)

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS