510 matches found
CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-17086
The ShortPixel Image Optimizer WordPress plugin (versions
PT-2026-95228
Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6 Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with...
CVE-2026-17086: Deserialization of Untrusted Data
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...
WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability
Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
WordPress EWWW Image Optimizer plugin < 8.7.7 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin EWWW Image Optimizer versions 8.7.7...
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin, in versions before 8.7.7 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from the failure to properly escape image attribute values during the page output rewriting process. This flaw allows authenticated users with author-l...
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
EUVD-2026-81354
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
PT-2026-94178
Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.7 Description Authenticated users with author-level access and above can inject arbitrary JavaScript into published content. This occurs because the plugin fails to properly escape image attribute...
CVE-2026-91011: Improper Neutralization of Input During Web Page Generation
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
Next.js 16.4.0-canary.13 Server-Side Request Forgery
Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...
CVE-2026-84773
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773
EWWW Image Optimizer for WordPress (versions