373 matches found
CVE-2025-25163-Nuclei-Template
CVE-2025-25163을 위한 Nuclei 템플릿 🚀 개요 이 저장소는 WordPress용 Plugin A/B Image Optimizer 에서 Path Traversal 취약점CVE-2025-25163을 탐지하도록 특별히 설계된 Nuclei 템플릿을 제공합니다. 이 취약점은 민감한 서버 파일에 대한 무단 액세스를 허용하여 심각한 보안 위험을 제기합니다. 🔍 취약점 설명 CVE-2025-25163은 공격자가 파일 경로를 조작하여 의도된 디렉토리 구조를 벗어난 파일에 접근할 수 있게 하는 경로 순회 취약점입니다. 이 취약점을...
Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting
Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...
CVE-2023-40600
CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Неавторизованное раскрытие конфиденциальной информации через журнал отладки Описание Плагин EWWW Image Optimizer для WordPress уязвим к раскрытию конфиденциальной информации во всех версиях до 7.2.0 включительно через функцию debuglog. Это позволяет...
CVE-2025-25163
CVE-2025-25163 Плагин A/B Image Optimizer = 3.3 - Аутентифицированное Subscriber+ произвольное скачивание файлов Описание Плагин A/B Image Optimizer для WordPress подвержен уязвимости Directory Traversal во всех версиях до 3.3 включительно. Это позволяет аутентифицированным злоумышленникам с...
CVE-2026-84904
King Addons for Elementor WordPress plugin (versions 51.1.56–51.1.80 ) contains a missing per-object authorization vulnerability in its image-optimization actions. The actions are gated only on a coarse capability that lower-privileged users also hold, and ownership of the targeted object is neve...
CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-17086
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-17086
The ShortPixel Image Optimizer WordPress plugin (versions
WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability
Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin (versions before 8.7.7 ) fails to properly escape image attribute values when rewriting page output, specifically through image class attribute backreference expansion . This allows authenticated users with author-level access or above to inject arbitrary...
WordPress EWWW Image Optimizer plugin < 8.7.7 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin EWWW Image Optimizer versions 8.7.7...
EUVD-2026-81354
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
Next.js 16.4.0-canary.13 Server-Side Request Forgery
Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...
CVE-2026-84773
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...