Executive brief
The Auto Thumbnail plugin for WordPress, which helps automate image processing, contains a security flaw that allows users with basic posting privileges to inject malicious scripts into website pages. These scripts execute automatically whenever a visitor views the affected page, potentially leading to unauthorized actions or data theft. This impacts the integrity of the website and the security of its visitors.
Technical details
The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the athn_thumbnails() function. Specifically, the 'width' and 'height' attributes of the 'thumbnails' shortcode are concatenated directly into an HTML <img> tag without being properly neutralized. An authenticated attacker with contributor-level permissions or higher can exploit this by crafting a shortcode with malicious payloads in these attributes. When the page is rendered, the script is stored and executed in the context of any user who visits the page. This vulnerability exists in all versions up to and including 1.0.
Affected products
- WordPress Auto Thumbnail (automatic-thumbnail) Up to and including 1.0
Timeline
- 2026-05-27: advisory: Advisory published by Wordfence and NVD