PT-2026-51682 · WordPress · Image Sizes On Demand

Abdulsamad Yusuf · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-8622

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Image Sizes on Demand versions prior to 1.4

Description Insufficient input sanitization and output escaping in the PHP SELF server variable allow unauthenticated attackers to inject arbitrary web scripts. These scripts execute if a user is tricked into clicking a malicious link. The execution occurs only within the context of an administrator, as the settings page requires the manage options capability to render. Reflected Cross-Site Scripting is a flaw where a malicious script is reflected off a web application to the victim's browser.

Recommendations Update to a version later than 1.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8622

Affected Products

Image Sizes On Demand

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8622 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ebcbb7bf-99fd-4a74-a4d3-eabf9edcadc4?source=cve · Note
• https://plugins.trac.wordpress.org/browser/image-sizes-on-demand/trunk/settings.php#L8 · Note
• https://twitter.com/atomicedgeWAF/status/2069650832748851699 · Twitter Post