CVE-2026-8622
Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Server Variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The injected payload only executes in the context of an administrator, as the settings page requires the manage_options capability to render.
| CWE | CWE-79 |
| Vendor | pixelwelt |
| Product | image sizes on demand |
| Published | Jun 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for pixelwelt image sizes on demand
Be the first to know when new medium vulnerabilities affecting pixelwelt image sizes on demand are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
pixelwelt / Image Sizes on Demand
0 ≤ 1.3
References
Credits
Abdulsamad Yusuf