Race condition

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted o...

CVE-2021-24378 Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload

The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execut...

CVE-2021-24378

The CVE concerns the WordPress Autoptimize plugin prior to version 2.7.8. It does not validate for malicious files (e.g., .html) inside archives uploaded via the Import Settings feature. A high-privilege user could upload a crafted archive containing JavaScript in index.html inside the plugin dir...

CVE-2021-24377 Autoptimize < 2.7.8 - Race Condition leading to RCE

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted o...

CVE-2021-24377

The CVE-2021-24377 entry relates to the WordPress Autoptimize plugin (versions before 2.7.8). The issue arises during the Import Settings workflow: malicious files are attempted to be removed after extraction, but a race condition between disk extraction and removal can permit a Remote Code Execu...

CVE-2021-24376 Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files such as .php form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP...

CVE-2021-24376

The CVE-2021-24376 entry concerns the Autoptimize WordPress plugin prior to 2.7.8. The issue is a race-condition vulnerability where, after extracting an uploaded archive via Import Settings, the plugin attempts to delete malicious files (e.g., PHP) but does not fully inspect the extracted folder...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress Autoptimize plugin versions prior to 2.7.8, which allows an...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress Autoptimize plugin versions prior to 2.7.8, which allows an...

WordPress 竞争条件问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress Autoptimize plugin versions prior to 2.7.8, which allows an...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-37139)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Autoptimize WordPress plugin prior to...

CVE-2021-24332

The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues...

CVE-2021-24332

The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues...

Cross site scripting

The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues...

CVE-2021-24332

The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues...

CVE-2021-24332 Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)

The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues...

CVE-2021-24332

CVE-2021-24332 affects the WordPress Autoptimize plugin before version 2.8.4. The vulnerability stems from missing escaping and sanitisation in certain settings, enabling highly privileged (authenticated) users to inject XSS payloads that are stored (stored XSS). Documented impacts include authen...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Autoptimize WordPress plugin prior to...

Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues PoC Adds the following payloads in the API Key settings /wp-admin/options-general.php?page=aocritcss " -- PoC 1...

Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues Adds the following payloads in the API Key settings /wp-admin/options-general.php?page=aocritcss "alert/XSS/ --...