alttextai vulnerabilities

Products

• Alt Text AI – Automatically generate image alt text for SEO and accessibility 2
• Download Alt Text AI 2

Latest alttextai CVEs

Newest publication first

1. CVE-2026-91108 Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action

   Published 2026-10-03

   Medium·CVSS 4.3 EPSS 0.21%

   The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an act...

2. CVE-2026-25348 WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability

   Published 2026-02-19

   Medium·CVSS 5.3 EPSS 0.32%

   Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.10.15.

3. CVE-2025-46232 WordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerability

   Published 2025-04-22

   High·CVSS 8.8 EPSS 0.29%

   Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.9.93.

4. CVE-2024-4847 Alt Text AI – Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection

   Published 2024-05-15

   High·CVSS 8.8 EPSS 0.61%

   The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_post_id’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.