13 matches found
CVE-2026-2430 Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the addlazyload function that replaces all occurrences of \ssr...
CVE-2026-2430 Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the addlazyload function that replaces all occurrences of \ssr...
CVE-2024-12327
The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbgsavesettings function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2024-12327 LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbgsavesettings function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access...
CVE-2024-12327
CVE-2024-12327 concerns the LazyLoad Background Images WordPress plugin. The vulnerability is a missing capability check in pblzbg_save_settings(), allowing authenticated attackers with Subscriber-level access and above to modify the plugin’s settings. Affected versions are all up to and includin...
CVE-2024-12327 LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbgsavesettings function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access...
PT-2025-1817 · WordPress · Lazyload Background Images
Name of the Vulnerable Software and Affected Versions: LazyLoad Background Images plugin for WordPress versions up to and including 1.0.7 Description: The issue arises from a missing capability check on the pblzbg save settings function, allowing authenticated attackers with Subscriber-level acce...
WordPress LazyLoad Background Images plugin <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update vulnerability
Missing Authorization to Authenticated Subscriber+ Plugin Settings Update vulnerability discovered by Mika in WordPress Plugin LazyLoad Background Images versions = 1.0.7...
Malicious code in gd-lazyload (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90d948479614bae9834425c8b55cea31a806768bfd8f07769b04fd4132a8c700 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3311 Malicious code in gd-lazyload (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90d948479614bae9834425c8b55cea31a806768bfd8f07769b04fd4132a8c700 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-0969
The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfilteredhtml capability i...
norska (>=0.7.0 <=0.8.4), norska-frontend (>=0.7.4 <=0.9.11) +5 more potentially affected by CVE-2020-7642 via lazysizes (>=5.1.1 <=5.2.0)
lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov =0.2.4 Source cves: CVE-2020-7642 Source advisory: SNYK:JS-LAZYSIZES-567144...