In reply to Sarah Gooding.

Even though it's outdated, that plugin should still at least tell you if and where you have the timthumb script. Then just check it manually from there.