CVE-2025-24810CWE-79

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier

Medium · published January 28, 2025

CVSS v3.0
4.8
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.

The record
Technical detail
CVSS v3.0
4.8 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-28T04:36Z
EPSS history
Timeline
  • 28 JAN 04:36Z
    Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier
    cvelistv5