Executive brief
The Image Sizes on Demand plugin for WordPress, which helps manage image dimensions on websites, contains a security flaw that allows attackers to run malicious scripts in a site administrator's browser. To exploit this, an attacker must trick an administrator into clicking a malicious link. If successful, the attacker could potentially perform unauthorized actions on the website with the administrator's permissions, leading to site compromise or data theft.
Technical details
The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the PHP_SELF server variable within the settings.php file. An unauthenticated attacker can craft a malicious URL that, when visited by a logged-in administrator with 'manage_options' capabilities, executes arbitrary JavaScript in their browser session. This occurs because the settings page, which requires administrative privileges to render, reflects the unsanitized PHP_SELF variable. The vulnerability affects all versions up to and including 1.3. Security researchers recommend ensuring all WordPress plugins are updated to patched versions or removed if no longer maintained.
Affected products
- pixelwelt Image Sizes on Demand <= 1.3
Timeline
- 2026-06-24: disclosed: Vulnerability published to the CVE list.
- 2026-06-24: advisory: Wordfence published a vulnerability advisory.