CVE-2025-25163

CVE-2025-25163 Plugin A/B Image Optimizer = 3.3 - Authenticated Subscriber+ Arbitrary File Download Description The Plugin A/B Image Optimizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3. This makes it possible for authenticated attackers,...

CVE-2025-25163-Nuclei-Template

Nuclei Template for CVE-2025-25163 🚀 Overview This repository features a Nuclei template specifically designed to detect the Path Traversal vulnerability CVE-2025-25163 in the Plugin A/B Image Optimizer for WordPress. This vulnerability poses a critical security risk, allowing unauthorized access...

CVE-2023-40600

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log Description The EWWW Image Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.0 via the debuglog function. This makes it...

Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting

Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

Next.js 16.4.0-canary.13 Server-Side Request Forgery

Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...

CVE-2026-84773

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84773

EWWW Image Optimizer for WordPress (versions

EUVD-2026-70576

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

WordPress EWWW Image Optimizer plugin <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability discovered by UKO - Korea univ. in WordPress Plugin EWWW Image Optimizer versions = 8.7.3...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446

The EWWW Image Optimizer WordPress plugin (all versions up to and including 8.7.3 ) is vulnerable to Stored Cross-Site Scripting via the data-script Lazy Load attribute in post content. The root cause is insufficient input sanitization and output escaping: an attacker with contributor-level acces...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-62342

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-78309

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...

Inefficient Algorithmic Complexity

Overview next is a react framework. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the detectContentType path in next/dist/server/image-optimizer. An attacker can exhaust CPU in /next/image by sending a remotely hosted SVG that forces expensive...

CVE-2026-5821

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the ImageBackup::remove function where backup file paths stored in post meta are used directly in file deletion operations withou...

CVE-2026-5821

The CVE-2026-5821 entry details a vulnerability in the WordPress Image Optimizer plugin (versions up to 1.7.4). The root cause is insufficient path validation in Image_Backup::remove(), where backup file paths stored in the image_optimizer_metadata post meta are used directly for deletion without...

CVE-2026-5821 Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the ImageBackup::remove function where backup file paths stored in post meta are used directly in file deletion operations withou...