CVE-2026-8622: WordPress Image Sizes Plugin XSS Flaw

CVE-2026-8622 Overview

CVE-2026-8622 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Image Sizes on Demand plugin for WordPress. The flaw affects all versions up to and including 1.3. The vulnerability stems from insufficient input sanitization and output escaping of the PHP_SELF server variable in the plugin's settings.php file. Unauthenticated attackers can inject arbitrary web scripts into pages, but the injected payload only executes when an authenticated administrator with the manage_options capability is tricked into clicking a crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
Successful exploitation enables script execution in an administrator's browser context, which can lead to account takeover, plugin modification, or persistent backdoor installation on the WordPress site.

Affected Products

Image Sizes on Demand plugin for WordPress
All versions up to and including 1.3
WordPress sites where an administrator with manage_options can be social-engineered

Discovery Timeline

2026-06-24 - CVE-2026-8622 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-8622

Vulnerability Analysis

The Image Sizes on Demand plugin renders its administrative settings page using the settings.php script. The script references the $_SERVER['PHP_SELF'] value when building form actions or links without applying proper sanitization or output escaping. Attackers can manipulate PHP_SELF by appending path segments containing script payloads to the request URI. When the administrator loads the crafted URL, the reflected value is written into the HTML response and executed by the browser.

The attack requires user interaction, typically through a phishing link or embedded reference on an attacker-controlled site. Because the settings page is gated by the manage_options capability, the payload runs only in the administrator's session — making administrative accounts the direct target.

Root Cause

The root cause is the unsafe use of $_SERVER['PHP_SELF'] without invoking WordPress sanitization helpers such as esc_url() or esc_attr(). The relevant location is identified in the WordPress Plugin Code Reference. PHP exposes the requested script path through PHP_SELF, and any user-controlled path components after the script name are reflected back into output without filtering.

Attack Vector

The attack is network-based and requires no authentication on the attacker side. The attacker crafts a URL pointing to the plugin settings page with an injected payload in the URI path, then delivers it to a logged-in administrator via phishing, forum posts, or external sites. The vulnerability scope is changed because the executed script can act on behalf of the administrator within the WordPress admin context.

The injected payload typically appends script content after the settings page path, causing the browser to execute it when the page renders. Refer to the Wordfence Vulnerability Report for additional context on the exploitation pattern.

Detection Methods for CVE-2026-8622

Indicators of Compromise

Web server access logs containing requests to wp-admin/admin.php or plugin settings paths with suspicious URI segments resembling <script>, %3Cscript%3E, or encoded JavaScript handlers
Referer headers from external domains preceding administrator visits to the plugin settings page
Unexpected creation of new WordPress administrator accounts or modifications to plugin and theme files shortly after admin sessions
New scheduled tasks (wp_cron entries) or modified wp_options rows containing remote URLs

Detection Strategies

Inspect HTTP request logs for path traversal patterns and script tags injected into URIs targeting the Image Sizes on Demand plugin
Deploy a Web Application Firewall (WAF) rule that blocks requests containing reflected XSS payloads in the URI path
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on admin pages

Monitoring Recommendations

Alert on outbound HTTP requests from administrator browsers immediately following admin panel visits
Track changes to WordPress user roles, plugin files, and the wp_users table using file integrity monitoring
Correlate administrator login events with subsequent privileged actions to identify session abuse

How to Mitigate CVE-2026-8622

Immediate Actions Required

Deactivate the Image Sizes on Demand plugin until a patched release is available
Audit administrator accounts and rotate credentials and session tokens for users with the manage_options capability
Train administrators to avoid clicking unsolicited links targeting their WordPress installation

Patch Information

No official patched version was identified in the published CVE data at the time of writing. Site operators should monitor the WordPress plugin repository for updates beyond version 1.3 and apply them as soon as they are released.

Workarounds

Remove the plugin from production sites until a fix is published
Deploy a WAF rule that strips or blocks script payloads in URI paths targeting wp-admin endpoints
Restrict admin panel access by IP allow-list at the web server or reverse proxy layer
Enforce a strict Content Security Policy that disallows inline script execution in the WordPress admin area

bash

# Example nginx rule to block reflected XSS payloads against the plugin settings page
location ~* /wp-admin/.*image-sizes-on-demand.* {
    if ($request_uri ~* "(<|%3C)script|onerror=|javascript:") {
        return 403;
    }
}