CVE-2022-2450: Missing Authorization

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them...

CVE-2022-2450 reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them...

reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF

The plugin does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site. PoC...

reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls

The plugin lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them. Examples of actions where low-privileged users can directly ask - https://example.com/wp-admin/admin-ajax.php?action=resmushitbulkgetimages -...

reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls

The plugin lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them. PoC Examples of actions where low-privileged users can directly ask - https://example.com/wp-admin/admin-ajax.php?action=resmushitbulkgetimages -...

CVE-2022-2448 reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site Scripting

The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

WordPress Kraken.io Image Optimizer Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-38454

Cross-Site Request Forgery CSRF vulnerability in Kraken.io Image Optimizer plugin = 2.6.5 at WordPress...

CVE-2022-38454

Cross-Site Request Forgery CSRF vulnerability in Kraken.io Image Optimizer plugin = 2.6.5 at WordPress...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Kraken.io Image Optimizer plugin = 2.6.5 at WordPress...

CVE-2022-38454

The CVE-2022-38454 entry affects the WordPress Kraken.io Image Optimizer plugin, versions

CVE-2022-38454 WordPress Kraken.io Image Optimizer plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Kraken.io Image Optimizer plugin = 2.6.5 at WordPress...

PT-2022-24413 · Kraken.Io · Kraken.Io Image Optimizer

Name of the Vulnerable Software and Affected Versions: Kraken.io Image Optimizer plugin versions = 2.6.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

CVE-2022-38454: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Kraken.io Image Optimizer plugin = 2.6.5 at WordPress...

WordPress Kraken.io Image Optimizer plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability was discovered by Rasi Afeef Patchstack Alliance in the WordPress Kraken.io Image Optimizer plugin versions = 2.6.5. Solution Update the WordPress Kraken.io Image Optimizer plugin to the latest available version at least 2.6.6...

Kraken.io Image Optimizer < 2.6.6 - Settings Update via CSRF

The plugin does not have CSRF check when updating its settings, which could allow attackers to make logged in admin change them via a CSRF attack...

reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed. PoC POST /wp-admin/options.php HTTP/1.1 Accept:...

WordPress reSmush.it Image Optimizer plugin <= 0.4.5 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Raad Haddad Cloudyrion GmbH in WordPress reSmush.it Image Optimizer plugin versions = 0.4.5. Solution Update the WordPress reSmush.it plugin to the latest available version at least 0.4.6...

reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed. POST /wp-admin/options.php HTTP/1.1 Accept:...

ShortPixel Image Optimizer < 4.22.10 - Reflected Cross-Site Scripting

The plugin does not escape a generated URLs before outputting them back in an attribute, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/options-general.php?page=wp-shortpixel-settings&"alert/XSS/...