PT-2025-5579 · Unknown · Simple Image Sizes

Ibuki Sato · Published 2025-01-28 · Updated 2025-01-28 · CVE-2025-24810

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Image Sizes versions 3.2.3 and earlier

Description A cross-site scripting issue exists, allowing an arbitrary script to be executed on the web browser of a user with administrative privileges who accesses the settings screen. This can occur when the vulnerability is exploited.

Recommendations For versions 3.2.3 and earlier, update to a version later than 3.2.3 to resolve the issue. As a temporary workaround, consider restricting access to the settings screen for users with administrative privileges until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24810

Affected Products

Simple Image Sizes

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24810 · Security Note
• https://twitter.com/CVEnew/status/1884183315403661404 · Twitter Post
• https://wordpress.org/plugins/simple-image-sizes/#developers · Note
• https://t.me/cvenotify/108840 · Telegram Post
• https://jvn.jp/en/jp/JVN88046370 · Note
• https://t.me/cvedetector/16583 · Telegram Post