CVE-2026-4852 is a stored cross-site scripting vulnerability in the Image Source Control Lite – Show Image Credits and Captions WordPress plugin (versions up to 3.9.1). The vulnerability is due to improper neutralization of input (CWE-79) in the 'Image Source' attachment field, allowing authenticated users with Author-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users who view the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the level of Author, no user interaction needed, and scope changed. No vendor patch or official fix is currently documented.

Successful exploitation allows authenticated users with Author-level privileges or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and user session compromise. The vulnerability does not affect availability. There are no known public exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor for updates from the vendor or WordPress plugin repository for patches or official mitigation instructions.