CVE-2026-8622 is a reflected cross-site scripting vulnerability (CWE-79) in the Image Sizes on Demand plugin for WordPress, affecting all versions up to and including 1.3. The vulnerability is due to improper neutralization of input from the PHP_SELF server variable, which is used in web page generation without sufficient sanitization or output escaping. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript, which executes when an administrator visits the settings page that requires manage_options capability. This vulnerability allows limited impact, primarily affecting confidentiality and integrity in the context of an administrator's session.

An attacker can inject and execute arbitrary scripts in the administrator's browser context by exploiting the reflected XSS vulnerability. This can lead to theft of sensitive information accessible to the administrator, session hijacking, or other actions performed with administrator privileges. There is no direct impact on availability. The vulnerability requires user interaction (clicking a crafted link) and affects only administrators accessing the settings page.

No official patch or remediation has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links that could exploit this vulnerability. Monitoring for updates from pixelwelt or the WordPress plugin repository is recommended to apply any forthcoming fixes promptly.