Security Alert Summary
The ZoomifyWP Free plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the zoomify shortcode’s filename parameter. Authenticated users with Contributor-level access and above can inject script into pages via this parameter, and that script will execute when other users view the affected page.
CVE Details
- CVE ID: CVE-2026-1187
- Affected component: ZoomifyWP Free plugin for WordPress
- Affected versions: All versions up to and including 1.1
- Published: February 14, 2026 at 07:16:09 AM (timestamp as provided)
- Last modified: February 14, 2026 at 07:16:09 AM (timestamp as provided)
- CVSS v3.1:
Base Score: 6.4,Severity: MEDIUM,Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction: Authentication required (authenticated users). Privileges required: Contributor-level access and above (CVSS: PR:L). User interaction: None (UI:N).
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79
Technical Details
This is a stored XSS issue caused by insufficient input sanitization and output escaping of user-supplied shortcode attributes. The filename parameter of the zoomify shortcode can contain attacker-supplied script that is stored and later rendered in pages without proper escaping. As described in the CVE entry, authenticated attackers with Contributor-level access and above can inject arbitrary web scripts into pages; those scripts will execute whenever a user accesses an injected page.
The impact is limited to execution of attacker-controlled scripts in the context of the visiting user’s browser. The vulnerability does not, by itself, indicate server-side code execution or direct loss of availability, but it does allow client-side actions that can affect confidentiality and integrity of data accessible to the victim’s browser session.
How This Could Impact Your Website
Example scenario: an external contributor or internal staff member with Contributor privileges inserts a zoomify shortcode and places malicious payloads into the filename attribute when editing a page or post. The malicious script is stored and later executed when editors, administrators, or other users view the page. Depending on the privileges of the viewing user, this can expose information available to their account or perform actions available in their browser session.
- Exposure of internal user data visible to the viewer (for example, email addresses present on pages or in user-visible dashboards)
- Increased risk of targeted phishing or social engineering using data gathered from affected pages or user sessions
- Potential for session-based actions executed in the context of the viewing user, limited by that user’s privileges
“If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.”
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and higher privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and content changes for unusual behavior or unexpected shortcode usage.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/tags/1.1/zoomifyWP-free.php#L54
- https://plugins.trac.wordpress.org/browser/tz-zoomifywp-free/trunk/zoomifyWP-free.php#L54
- https://wordpress.org/plugins/tz-zoomifywp-free/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fa59e0-c946-40d3-a817-c9924b4588fa?source=cve
