41 matches found
CVE-2026-84934
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...
CVE-2025-15693
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...
EUVD-2026-71873
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...
CVE-2026-84934 JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...
CVE-2026-84934
CVE-2026-84934 affects the JCH Optimize WordPress plugin before 6.0.1 . The root cause is a missing capability check on an authenticated AJAX action that allows the request to select which internal action runs (specifically a getcacheinfo task override). This lets any authenticated user, includin...
CVE-2025-15693 JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...
WordPress JCH Optimize plugin 4.2.1-5.0.0 - Admin+ Path Traversal vulnerability
Admin+ Path Traversal vulnerability discovered by Krugov Artyom in WordPress Plugin JCH Optimize versions 4.2.1-5.0.0...
EUVD-2025-210849
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...
CVE-2025-15693 JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...
CVE-2025-15693
CVE-2025-15693 is a path traversal vulnerability in the JCH Optimize WordPress plugin, affecting versions 4.2.1 through 5.0.0 . The flaw occurs in an administrative image-browsing feature that fails to restrict directory paths to the site's web root, allowing high-privilege users (administrators ...
PT-2026-86357
šØ CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plug...
PT-2026-86316
šØ CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...
CVE-2023-25491
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Samuel Marshall JCH Optimize plugin = 3.2.2 versions...
EUVD-2024-35074
Malicious code in bioql PyPI...
EUVD-2024-28401
Malicious code in bioql PyPI...
EUVD-2023-29446
Malicious code in bioql PyPI...
CVE-2024-34808
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.2.0...
CVE-2024-30481
Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0...
CVE-2024-30481
Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0...
CVE-2024-30481 WordPress JCH Optimize plugin <= 4.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0...