CVE-2020-13459: 
PHP vulnerability analysis and mitigation

An issue was discovered in the Image Resizer plugin before version 2.0.9 for Craft CMS. The vulnerability involves stored Cross-Site Scripting (XSS) in the Bulk Resize action functionality. This vulnerability was identified and disclosed on May 25, 2020 (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue affecting the Bulk Resize action in the Image Resizer plugin. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires low attack complexity and low privileges but does need user interaction (NVD).

The vulnerability allows attackers to execute arbitrary web scripts or HTML through the Bulk Resize action. This could potentially lead to unauthorized access to sensitive information and compromise of user sessions within the application's context (NVD).

The vulnerability requires an attacker to have low-level privileges and user interaction for successful exploitation. The attack can be initiated remotely, making it accessible to network-based attackers (NVD).

The vulnerability was patched in Image Resizer plugin version 2.0.9. Users are strongly advised to upgrade to this version or later to address the security issue. The fix was implemented to prevent stored XSS in the Bulk Resize action (Changelog).

The vulnerability was discovered and reported by security researcher Paweł Hałdrzyński from Limpid Security, demonstrating the active security research community's involvement in identifying and responsibly disclosing such issues (Changelog).