WP Manifestindependent plugin directory
manifest / ai / ai-alt-text

AI Alt Text WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Generate alt text for images using AI. Supports multiple AI providers including OpenAI, Claude, Gemini, Ollama, Azure OpenAI, and Grok.

★ 1stars
68release downloads
1.0.3latest · 10mo ago

Install

Download ai-alt-text.zip From the 1.0.3 release on GitHub, Nov 27, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/soderlind/ai-alt-text/releases/download/1.0.3/ai-alt-text.zip

On Packagist as soderlind/ai-alt-text:

composer require soderlind/ai-alt-text
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Generate alt text for images using AI. Supports multiple AI providers including OpenAI, Claude, Gemini, Ollama, Azure OpenAI, and Grok.

AI Alt Text Plugin Screenshot

Features

  • Bulk Update: Update alt text for multiple images at once from the media library
  • Block Editor Integration: Generate alt text directly from the image block in the editor
  • Multiple AI Providers: Choose from OpenAI (GPT-4o), Anthropic Claude, Google Gemini, Azure OpenAI, Ollama (local), or Grok
  • Language Detection: Automatically uses WordPress language settings for generated alt text
  • Flexible Configuration: Configure via constants, environment variables, or the admin settings page

Requirements

  • WordPress 6.8 or higher
  • PHP 8.3 or higher
  • API key for your chosen AI provider (except Ollama which runs locally)

Installation

  • Quick Install

    • Download ai-alt-text.zip
    • Upload via Plugins > Add New > Upload Plugin
    • Activate the plugin.
    • Go to Settings → AI Alt Text to configure your AI provider
  • Composer Install

     composer require soderlind/ai-alt-text
  • Updates

Configuration

Via Admin Settings

Navigate to Settings → AI Alt Text and configure:

  1. Select your AI provider
  2. Enter your API key
  3. Optionally customize the model and other settings

Via Constants (wp-config.php)

// AI Provider: 'openai', 'anthropic', 'gemini', 'azure', 'ollama', 'grok'
define( 'AI_ALT_TEXT_PROVIDER', 'openai' );

// API Key
define( 'AI_ALT_TEXT_API_KEY', 'your-api-key-here' );

// Optional: Custom model
define( 'AI_ALT_TEXT_MODEL', 'gpt-4o' );

// Azure-specific settings
define( 'AI_ALT_TEXT_AZURE_ENDPOINT', 'https://your-resource.openai.azure.com' );
define( 'AI_ALT_TEXT_AZURE_DEPLOYMENT', 'your-deployment-name' );

// Ollama-specific settings
define( 'AI_ALT_TEXT_OLLAMA_HOST', 'http://localhost:11434' );

Via Environment Variables

AI_ALT_TEXT_PROVIDER=openai
AI_ALT_TEXT_API_KEY=your-api-key-here
AI_ALT_TEXT_MODEL=gpt-4o

Usage

Bulk Update

  1. Go to Media → Library (list view)
  2. Select images you want to update
  3. Choose "Generate AI Alt Text" from the bulk actions dropdown
  4. Click "Apply"

From the Block Editor

  1. Add or select an image block
  2. In the sidebar, find the "AI Alt Text" panel
  3. Click "Generate Alt Text with AI"

AI Providers

Provider Model Notes
OpenAI gpt-4o Requires API key from OpenAI
Anthropic claude-sonnet-4-20250514 Requires API key from Anthropic
Google Gemini gemini-2.0-flash Requires API key from Google AI Studio
Azure OpenAI gpt-4o Requires Azure subscription and deployment
Ollama llava Free, runs locally. Install from ollama.ai
Grok grok-2-vision-1212 Requires API key from xAI

For detailed configuration instructions, see AI Provider Documentation.

Hooks & Filters

Modify Generated Alt Text

add_filter( 'ai_alt_text_generated', function( $alt_text, $attachment_id ) {
    // Modify the generated alt text
    return $alt_text;
}, 10, 2 );

Customize the AI Prompt

add_filter( 'ai_alt_text_prompt', function( $prompt, $language ) {
    // Customize the prompt sent to the AI
    return $prompt;
}, 10, 2 );

Skip Auto-generation for Specific Images

add_filter( 'ai_alt_text_should_generate', function( $should_generate, $attachment_id ) {
    // Return false to skip auto-generation
    return $should_generate;
}, 10, 2 );

Translations

The plugin is translation-ready. Translation files are located in the languages/ directory.

Creating a Translation

  1. Copy languages/ai-alt-text.pot to languages/ai-alt-text-{locale}.po
    • Example: ai-alt-text-nb_NO.po for Norwegian Bokmål
    • Example: ai-alt-text-de_DE.po for German
  2. Translate the strings using Poedit or similar tool
  3. Save to generate the .mo file
  4. For JavaScript translations, run:
    wp i18n make-json languages/

Available Locales

Contributions welcome! Submit your translation via a pull request.

Development

Building Assets

npm install
npm run build

Running Tests

# JavaScript tests
npm test

# PHP tests
./vendor/bin/phpunit

Code Standards

# Check PHP code standards
./vendor/bin/phpcs

# Fix PHP code standards
./vendor/bin/phpcbf

License

GPL v2 or later. See LICENSE for details.

Credits

Developed by Per Soderlind.

Support

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.3 latest
Nov 27, 2025 10mo ago
ai-alt-text.zip
61
Nov 27, 2025 10mo ago
ai-alt-text.zip
3
Nov 27, 2025 10mo ago
ai-alt-text.zip
3
Nov 27, 2025 10mo ago
ai-alt-text.zip
1
D+ grade

Security

AI Alt Text 1.0.3 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.0.3
Findings
2
Worst severity
high
Content hash
b7daea16d78ea8ace2b65de1…

Findings

  • high Authenticated SSRF via REST image_url for Anthropic/Gemini/Ollama

    ssrf

    The REST route ai-alt-text/v1/generate accepts optional image_url (esc_url_raw only) for any user with upload_files. When the configured provider is Anthropic, Gemini, or Ollama, LLMClient::getImageAsBase64() performs wp_remote_get() on that URL (or maps upload-base URLs to filesystem paths via str_replace). An Author-equivalent attacker can force the WordPress host to fetch internal/cloud-metadata URLs or traverse under the uploads path mapping.

    src/php/AI/LLMClient.php:284-326

    Recommendation

    Restrict image_url to attachment URLs the current user can edit; reject non-http(s) schemes and private/reserved IPs; do not map URLs to filesystem via naive str_replace; prefer reading only by attachment ID after current_user_can('edit_post', $id).

  • medium Alt text overwrite without edit_post capability check

    missing_capability

    ajaxGenerateAltText and REST generateAndSave update _wp_attachment_image_alt for any attachment_id when the caller has upload_files, without verifying current_user_can('edit_post', $attachment_id). Authors can overwrite alt text on media they cannot edit.

    src/php/Media/MediaLibraryHandler.php:83-105

    Recommendation

    Require current_user_can( 'edit_post', $attachment_id ) (and for REST, the same) before generateAndSave/updateAttachmentAltText.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.