4946 matches found
CVE-2026-84904
King Addons for Elementor WordPress plugin versions 51.1.56 through 51.1.80 are affected by a missing per-object authorization flaw in its image-optimization actions . The plugin gates these actions only on a coarse capability held by lower-privileged roles and never confirms ownership of the tar...
CVE-2025-25163
CVE-2025-25163 Plugin A/B Image Optimizer = 3.3 - Descarga Arbitraria de Archivos Autenticada Suscriptor+ Descripción El plugin A/B Image Optimizer para WordPress es vulnerable a Directory Traversal en todas las versiones hasta la 3.3 inclusive. Esto permite a atacantes autenticados, con acceso d...
WordPress ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin <= 6.5.5 - Authenticated (Author+) PHP Object Injection vulnerability
Authenticated Author+ PHP Object Injection vulnerability discovered by Josh Bolding in WordPress Plugin ShortPixel Image Optimizer versions = 6.5.5...
CVE-2023-40600
CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Exposición de Información Sensible no Autenticada a través del Registro de Depuración Descripción El plugin EWWW Image Optimizer para WordPress es vulnerable a la Exposición de Información Sensible en todas las versiones hasta la 7.2.0 incluida, a...
CVE-2025-25163-Nuclei-Template
Plantilla de Nuclei para CVE-2025-25163 🚀 Descripción general Este repositorio incluye una plantilla de Nuclei diseñada específicamente para detectar la vulnerabilidad de Path Traversal CVE-2025-25163 en el Plugin A/B Image Optimizer para WordPress. Esta vulnerabilidad representa un riesgo de...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-91011
EWWW Image Optimizer is a WordPress plugin that optimizes images on pages. Versions before 8.7.7 contain a stored cross-site scripting (XSS) vulnerability caused by improper escaping of image attribute values during page output rewriting, specifically through image class attribute backreference e...
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
EUVD-2026-81354
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting
Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...
CVE-2026-31891
SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw Vulnerability Class : SQL Injection CWE-89 Product : Cockpit CMS Core Edition Affected Version : 2.13.4 and likely all versions since the Aggregation Optimizer was introduced Docker Image Tested : cockpithq/cockpit:core-2.13.4...
Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022363)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022363 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and...
Next.js 16.4.0-canary.13 Server-Side Request Forgery
Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106206)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106206 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106181)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106181 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106186)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106186 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server:...
CVE-2026-84773
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...