The Image Sizes on Demand WordPress plugin is vulnerable because the PHP_SELF server variable is echoed directly without sanitization or escaping, allowing an attacker to inject arbitrary client‑side scripts into the plugin’s settings page. An unauthenticated attacker can craft a URL that includes malicious payloads and trick an administrator into visiting it; the script then executes within the administrator’s browser context.

WordPress sites running the pixelwelt Image Sizes on Demand plugin version 1.3 or earlier are affected. No other vendors or products are listed as impacted.

The CVSS score of 6.1 reflects moderate severity. No EPSS score is available and the flaw is not in CISA’s KEV catalog, indicating that widespread exploitation has not yet been documented. Successful exploitation requires an admin to click a malicious link, after which the injected script runs as the admin, potentially allowing theft of session cookies or other privileged data confined to the settings page. Overall the risk remains moderate but should not be ignored on active WordPress sites.