CVE-2025-13401

CVE-2025-13401 : Autoptimize for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.1.13 due to insufficient input sanitization and output escaping in create_img_preload_tag. Exploitation requires authenticated access at Contributor level or higher, allowing injection of s...

Link Preload XSS bypass

Description Link preloads still do not effectively confirm if the requested link is external. This is a bypass to the fix for CVE-2022-4414. Root Cause The getPayloadURL function was adapted after the disclosure to use the browsers built in URL parser to properly check for a valid URL. This is a...

CVE-2021-26600

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass != instead of !==...

CVE-2021-26600

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass != instead of !==...

CVE-2021-26600: Access of Resource Using Incompatible Type

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass != instead of !==...

PT-2022-9762

Name of the Vulnerable Software and Affected Versions ImpressCMS versions prior to 1.4.3 Description The issue is related to a type confusion in the autologin.php file within the plugins/preloads directory, leading to an Authentication Bypass. This occurs due to the use of the != operator instead...