CVE-2025-28918

Summary

CVE-2025-28918 is a Cross-Site Scripting (XSS) vulnerability affecting the A. Jones Featured Image Thumbnail Grid plugin. The issue allows attackers to inject malicious scripts into web pages generated by the plugin due to improper input neutralization. This flaw, present in versions from n/a to 6.6.1, could lead to stolen user data or unauthorized actions. Attackers can exploit this vulnerability by tricking users into visiting a specially crafted webpage or by injecting the malicious code into a comment or post. Users are advised to update their plugin to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.