Skip to content
OpenAdvisories
Medium · 6.4 CVE-2025-15019 EUVD-2026-1791GHSA-mj4h-gvfv-49mm

BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published Jan 9, 2026 · Updated Apr 8, 2026 · Assigned by Wordfence

Description

The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bialty_cs_alt' post meta in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the post editor.

Affected products

VendorProductAffectedFixed
pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) ≤ 2.2.1 —

References