Media: Exclude IMG from cross-origin injection in media templates

[i-am-chitti]

Trac ticket

https://core.trac.wordpress.org/ticket/65673

Problem

Under Document-Isolation-Policy: isolate-and-credentialless, the browser already loads cross-origin images in credentialless mode without requiring CORS headers. Adding crossorigin="anonymous" overrides that and forces a CORS request, so images served from a host without Access-Control-Allow-Origin (e.g. offloaded/CDN media) fail to load.

The fix in https://core.trac.wordpress.org/changeset/62048 removed IMG from wp_add_crossorigin_attributes() in media.php, but the media library picker never uses that function. It has a separate injection path in https://github.com/i-am-chitti/wordpress-develop/blob/9ace411f9e9c39a16d989dce7b617835ef864561/src/wp-includes/media-template.php#L156 that rewrites the Backbone <script type="text/html"> templates and adds crossorigin="anonymous" unconditionally to AUDIO, IMG, and VIDEO. That IMG entry was never part of the https://core.trac.wordpress.org/ticket/64886 fix — it has been present since the original backport, and returned to shipping builds when the client-side media processing feature was re-introduced in 7.1beta2. As a result, every <img> in the picker receives crossorigin="anonymous" and offloaded-media previews break.

Fix

Remove IMG from the tag list in wp_print_media_templates(), keeping AUDIO and VIDEO, which still need the attribute for media processing and error reporting. This mirrors https://core.trac.wordpress.org/changeset/62048.

Testing

Added regression coverage to Tests_Media_wpCrossOriginIsolation:

• test_media_templates_do_not_add_crossorigin_to_img — no <img> in the rendered media templates receives a crossorigin attribute.
• test_media_templates_add_crossorigin_to_audio_and_video — <audio>/<video> still receive crossorigin="anonymous".

Manually verified against the rendered templates: <img> tags with crossorigin dropped from 17 → 0 with the fix, while <audio>/<video> stayed at 3 each.

Manual reproduction

1. Rewrite attachment URLs to a non-CORS host (e.g. filter wp_prepare_attachment_for_js to point url/sizes[*].url at https://placehold.jp/1024x768.jpg). Mu-plugin here - https://gist.github.com/i-am-chitti/3bcbd7d41221a1fd7d8d65bb4ca61d2f
2. Open the media modal (Add Media / Image block → Media Library) and inspect a grid thumbnail: before the fix it carries crossorigin="anonymous" and fails with a CORS error; after the fix the attribute is gone and the preview loads.

Screenshots

Before -

After -

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Opus 4.8
Used for: used to help investigate this issue and prepare the patch. All changes were reviewed, tested, and verified by me before submitting.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props iamchitti.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.