CVE-2025-24810

MEDIUM

Simple Image Sizes <= 3.2.3 - Authenticated Stored Cross-Site Scripting in Settings Screen

Title source: llm

Description

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.

References (2)

Core 2

Core References

Product

https://wordpress.org/plugins/simple-image-sizes/#developers

Third Party Advisory

https://jvn.jp/en/jp/JVN88046370/

Scores

CVSS v3 4.8

EPSS 0.0026

EPSS Percentile 17.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

Rahe/Simple Image Sizes 3.2.3 and earlier

Published Jan 28, 2025

Tracked Since Feb 18, 2026