PatchSiren cyber security CVE debrief
CVE-2026-8899 gapgag55 CVE debrief
A stored cross-site scripting (XSS) vulnerability in the Auto Thumbnail WordPress plugin allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'thumbnails' shortcode. The vulnerability exists in all versions up to and including 1.0 due to insufficient input sanitization and output escaping on the 'width' and 'height' attributes in the athn_thumbnails() function, which are concatenated directly into an HTML <img> tag. When a page containing the malicious shortcode is viewed, the injected scripts execute in the context of the victim's browser. The vulnerability was disclosed on 2026-05-27 with a CVSS 3.1 score of 6.4 (Medium severity).
- Vendor
- gapgag55
- Product
- Auto Thumbnails
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
WordPress site administrators using the Auto Thumbnail plugin, security teams monitoring WordPress plugin vulnerabilities, and organizations with multi-user WordPress installations where contributor or author roles are granted to untrusted users.
Technical summary
The Auto Thumbnail plugin for WordPress (≤1.0) contains a stored XSS vulnerability in the athn_thumbnails() function. The 'width' and 'height' attributes of the 'thumbnails' shortcode are not properly sanitized or escaped before being concatenated into an HTML <img> tag. This allows authenticated attackers with contributor-level access or above to inject malicious JavaScript payloads that execute when any user views the compromised page. The vulnerability is classified as CWE-79 and has a CVSS 3.1 score of 6.4 (Medium).
Defensive priority
medium
Recommended defensive actions
- Update the Auto Thumbnail plugin to a version newer than 1.0 when available, or remove the plugin if updates are not forthcoming.
- Implement Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities by restricting script execution sources.
- Apply the principle of least privilege by reviewing and limiting user roles with contributor or higher access.
- Consider using WordPress security plugins that provide shortcode attribute sanitization as a defense-in-depth measure.
- Monitor for unauthorized shortcode usage in post and page content through regular security audits.
Evidence notes
Vulnerability confirmed via WordPress plugin repository source code review (lines 13 and 34 of index.php in version 1.0) and Wordfence threat intelligence. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as the root cause. Attack vector requires authenticated access with contributor privileges or higher.
Official resources
2026-05-27