510 matches found
PT-2026-103037
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...
PT-2026-103242
Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...
PT-2026-103038
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...
PT-2026-103036
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...
PT-2026-103040
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...
CVE-2026-97246: Deserialization of Untrusted Data
Subscriber PHP Object Injection in ShortPixel Image Optimizer = 6.5.5 versions...
CVE-2026-91072: External Control of File Name or Path
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...
CVE-2026-90953: Exposure of Sensitive Information to an Unauthorized Actor
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...
CVE-2026-97067: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.7 versions...
CVE-2026-89193: Improper Neutralization of Input During Web Page Generation
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...
CVE-2026-89190: Improper Access Control
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...
PT-2026-103225
Contributor Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.7 versions...
CVE-2026-91051: Deserialization of Untrusted Data
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...
CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-84904
The King Addons for Elementor WordPress plugin (versions 51.1.56 through 51.1.80 ) contains an authorization flaw where it fails to perform per-object authorization checks on specific image-optimization actions. The plugin relies on coarse capabilities held by lower-privileged users without verif...
CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-17086
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...