CVE-2026-8899

Name of the Vulnerable Software and Affected Versions Auto Thumbnail versions prior to 1.1

Description Stored Cross-Site Scripting occurs via the 'thumbnails' shortcode. The issue stems from insufficient input sanitization and output escaping within the athn thumbnails() function for the width and height attributes, which are concatenated directly into an HTML tag. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update to a version later than 1.0. As a temporary mitigation, restrict the ability of users with contributor-level access to use the 'thumbnails' shortcode.