medium · CVSS v3 5.3

CVE-2026-120578

The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin…

Description

The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the alt text, and optionally the title, caption, and description of arbitrary attachments owned by other users. Exploiting this vulnerability requires a Contributor-level account to retrieve the nonce from the page source of post.php, post-new.php, or upload.php; additionally, overwriting post_title, post_excerpt, and post_content requires the plugin's set_title, set_caption, or set_description options to be enabled.

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

View analysis

medium

CVE-2026-120524

The News Kit Addons For Elementor plugin for WordPress is vulnerable to stored XSS via the formData parameter, allowing authenticated subscribers to inject arbitrary scripts. These scripts execute whenever a user views an affected page, enabling defacement or data theft. The flaw stems from insufficient sanitization and an operator-precedence bug that exposes the admin bundle to subscriber-level screens.

View analysis

medium

CVE-2026-120544

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.

View analysis

medium

CVE-2026-120551

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

View analysis