CVE-2026-39665

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A DOM-based Cross-site Scripting vulnerability in the SEO Friendly Images plugin allows injection of malicious client-side scripts. The issue affects versions up to and including 3.0.5.

Risk Assessment

An attacker could execute arbitrary scripts in the victim's browser, potentially leading to session theft, redirects, or data theft.

Recommendation

Update the SEO Friendly Images plugin to the latest version that includes input sanitization fixes.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DOM-Based XSS.This issue affects SEO Friendly Images: from n/a through <= 3.0.5.