CVE-2026-8622 is a reflected cross-site scripting vulnerability in the Image Sizes on Demand WordPress plugin (pixelwelt) affecting all versions up to and including 1.3. The vulnerability stems from improper neutralization of input in the PHP_SELF server variable, allowing injection of arbitrary web scripts. Exploitation requires tricking an administrator into clicking a malicious link, leading to script execution in the administrator's context on the plugin's settings page. The vulnerability is classified as CWE-79 and has a CVSS 3.1 base score of 6.1 (medium severity). No official patch or remediation has been disclosed as of the publication date.

An attacker can perform reflected XSS attacks by injecting malicious scripts that execute with administrator privileges when the administrator accesses the plugin's settings page. This can lead to limited confidentiality and integrity impacts, such as theft of admin session tokens or manipulation of plugin settings. There is no direct impact on availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links that could exploit this vulnerability. Monitoring vendor channels for an official update or patch is recommended.