CVE-2026-1373 is a stored cross-site scripting vulnerability in the Easy Author Image plugin for WordPress, affecting all versions up to and including 1.7. The vulnerability exists because the plugin does not properly sanitize or escape input provided via the 'author_profile_picture_url' parameter. Authenticated attackers with Subscriber-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with an attack vector of network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts confidentiality and integrity with no availability impact. A patch is available to remediate this issue.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to inject malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of user data or session hijacking within the scope of the WordPress site. There is no impact on availability. No known exploits are reported in the wild at this time.

An official patch is available for this vulnerability. Users of the Easy Author Image plugin should update to the latest version beyond 1.7 to remediate the issue. Until patched, restrict user privileges to trusted users only and consider disabling or removing the plugin if possible. Monitor vendor advisories for updated remediation guidance.