CVE-2026-8622: Image Sizes on Demand WordPress Plugin Reflected XSS Vulnerability

Technical summary

The vulnerability is a Reflected XSS flaw (CWE-79) in versions ≤1.3 of the Image Sizes on Demand plugin. The plugin's settings page fails to properly sanitize and escape the PHP_SELF variable before rendering it in HTML output. An unauthenticated attacker can inject a crafted payload through a specially constructed URL, causing arbitrary JavaScript to execute in the administrator's browser when they access the page. The attack requires social engineering—convincing an admin to click a malicious link—but the payload executes with full administrative privileges once triggered, allowing account compromise, plugin/theme manipulation, or other site-level attacks.

Business impact

Successful exploitation allows an attacker to perform actions as a WordPress administrator without their credentials, potentially leading to unauthorized content modification, installation of malicious plugins or themes, user account creation, data exfiltration, or complete site compromise. Since the attack vector is reflected and requires user interaction, the practical risk depends on how effectively an attacker can socially engineer an administrator into clicking a malicious link. Organizations running this plugin on production sites should prioritize remediation to prevent privilege escalation through phishing or link injection tactics.

Affected systems

The Image Sizes on Demand WordPress plugin is affected in all versions up to and including version 1.3. The vulnerability is specific to the plugin's settings page and requires an administrator to visit the malicious URL. Any WordPress installation with this plugin active is in scope; the risk is highest for sites where administrators frequently click links from untrusted or compromised email or messaging channels.

Exploitability

This is a reflected XSS vulnerability with medium exploitability. No authentication is required to craft the malicious URL, but the attack depends on social engineering—the attacker must trick an administrator into clicking the link. Once clicked, the payload executes in the admin's session with full administrative permissions, enabling account takeover or site manipulation. The attack surface is the plugin's settings page, which is easily identifiable. No active exploit code is known to be in the wild yet (CISA KEV status is not assigned), but the attack is straightforward to execute once a victim is engaged.

Remediation

Users should upgrade the Image Sizes on Demand plugin to a patched version released after 1.3. Verify the latest available version on the WordPress plugin repository or the vendor's advisory. Until patching is possible, administrators should avoid clicking untrusted links targeting their WordPress admin panel, and consider restricting access to the plugin's settings page via IP whitelisting or Web Application Firewall (WAF) rules. If the plugin is not actively used, disabling or removing it is the safest interim measure.

Patch guidance

Check the WordPress plugin directory and the vendor's advisory for the first patched version after 1.3. Apply the update immediately once available. Patch deployment should be prioritized for any WordPress site where administrators may be exposed to phishing or social engineering campaigns. Verify the update has been applied by confirming the plugin version in the WordPress admin dashboard.

Detection guidance

Monitor web server logs for GET requests to the plugin's settings page (typically /wp-admin/admin.php?page=image-sizes-on-demand or similar) that contain unusual query parameters or URL-encoded payloads, particularly those containing script tags or JavaScript event handlers. Watch for administrator account logins from unexpected IP addresses or user agents following suspicious link clicks. Enable logging of reflected XSS attempts via Web Application Firewall or intrusion detection systems tuned to recognize common XSS payloads in HTTP requests. Consider periodic security audits of administrator account activity.

Why prioritize this

This vulnerability warrants prompt attention due to the administrative context of exploitation. While it requires user interaction, a successful attack grants full site control. The plugin's visibility and ease of access make it an attractive target for phishing-based privilege escalation. Organizations should patch within 1-2 weeks, especially if their administrators regularly interact with external communications or if the site processes sensitive data.

Risk score, explained

CVSS 6.1 (Medium) reflects the balance between attack requirements and impact. The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-based, low-complexity, unauthenticated attack requiring user interaction, with limited confidentiality and integrity impact—appropriate for a reflected XSS that executes only in admin context. The score appropriately captures that while the technical barrier is low, social engineering is necessary, and the impact is confined to administrative scope rather than system-wide availability.

Frequently asked questions